{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-NODEJS-17268893",
"cpes": [],
"title": "CVE-2026-45447",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447"
},
{
"url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt",
"title": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25237",
"title": "https://access.redhat.com/errata/RHSA-2026:25237"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239",
"title": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26275",
"title": "https://access.redhat.com/errata/RHSA-2026:26275"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26319",
"title": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29197",
"title": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34102",
"title": "https://access.redhat.com/errata/RHSA-2026:34102"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35869",
"title": "https://access.redhat.com/errata/RHSA-2026:35869"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36215",
"title": "https://access.redhat.com/errata/RHSA-2026:36215"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36217",
"title": "https://access.redhat.com/errata/RHSA-2026:36217"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39009",
"title": "https://access.redhat.com/errata/RHSA-2026:39009"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39012",
"title": "https://access.redhat.com/errata/RHSA-2026:39012"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39981",
"title": "https://access.redhat.com/errata/RHSA-2026:39981"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447",
"title": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44438",
"title": "https://access.redhat.com/errata/RHSA-2026:44438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"title": "https://access.redhat.com/errata/RHSA-2026:47735"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47737",
"title": "https://access.redhat.com/errata/RHSA-2026:47737"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58563",
"title": "https://access.redhat.com/errata/RHSA-2026:58563"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58981",
"title": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59831",
"title": "https://access.redhat.com/errata/RHSA-2026:59831"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66524",
"title": "https://access.redhat.com/errata/RHSA-2026:66524"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n",
"epssDetails": {
"percentile": "0.88452",
"probability": "0.03566",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-45447"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-06-10T02:46:34.655313Z",
"disclosureTime": "2026-06-09T17:17:19.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-06-10T02:46:34.660471Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-12T01:29:09.004017Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-ai-server@2.50.21_47ddc85.4286",
"nodejs@24.21.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.21.0-1nodesource1"
}
],
"ok": false,
"dependencyCount": 141,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "1 high or critical severity vulnerable dependency path",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 1,
"projectName": "docker-image|docker.io/scopear/docker-ai-server",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.50.21_47ddc85.4286/scopear/docker-ai-server",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"html-to-text@9.0.5",
"deepmerge@4.3.1"
],
"upgradePath": [
false,
"html-to-text@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-FASTURI-18506908",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"alanturing881"
],
"semver": {
"vulnerable": [
"<2.4.4",
">=3.0.0 <3.1.5",
">=4.0.0 <4.1.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.4",
"3.1.5",
"4.1.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in `parseWithStatus()` and `resolve()` in `index.js`. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses `\\\\`, `/\\\\`, or `\\\\/` in place of `//` after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG `URL` treats them as a real authority on special schemes such as `http`, `https`, `ws`, `wss`, `ftp`, and `file`. Applications that validate a URL with `fast-uri` and then pass the same input to `fetch()`, `undici`, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.\n## Remediation\nUpgrade `fast-uri` to version 2.4.4, 3.1.5, 4.1.2 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7)\n",
"epssDetails": {
"percentile": "0.12820",
"probability": "0.00221",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18446"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-7p8r-x3mc-p8w7"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-02T09:20:09.869725Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T17:55:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T09:20:10.035273Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-23T15:25:44.164672Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-18506908",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"alanturing881"
],
"semver": {
"vulnerable": [
"<2.4.4",
">=3.0.0 <3.1.5",
">=4.0.0 <4.1.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.4",
"3.1.5",
"4.1.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in `parseWithStatus()` and `resolve()` in `index.js`. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses `\\\\`, `/\\\\`, or `\\\\/` in place of `//` after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG `URL` treats them as a real authority on special schemes such as `http`, `https`, `ws`, `wss`, `ftp`, and `file`. Applications that validate a URL with `fast-uri` and then pass the same input to `fetch()`, `undici`, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.\n## Remediation\nUpgrade `fast-uri` to version 2.4.4, 3.1.5, 4.1.2 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7)\n",
"epssDetails": {
"percentile": "0.12820",
"probability": "0.00221",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18446"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-7p8r-x3mc-p8w7"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-02T09:20:09.869725Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T17:55:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T09:20:10.035273Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-23T15:25:44.164672Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.4"
},
{
"id": "SNYK-JS-HONO-19499068",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"credit": [
"Paco Cartones",
"Leon Marcos"
],
"semver": {
"vulnerable": [
"<4.13.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.13.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "hono",
"references": [
{
"url": "https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221",
"title": "GitHub Commit"
},
{
"url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T11:52:47.378539Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T11:52:47.378539Z"
}
],
"description": "## Overview\n[hono](https://www.npmjs.org/package/hono) is an Ultrafast web framework for the Edges\n\nAffected versions of this package are vulnerable to Directory Traversal in the `toSSG()` static site generation function, whose path normalization does not fully collapse runs of consecutive `..` segments and treats output directories that differ only in how they are rooted as equivalent. An attacker can cause build output to be written outside the intended output directory by supplying a route parameter with enough `..` sequences that reaches `ssgParams` from an untrusted source. \r\n\r\n**Note:** This affects build-time static site generation only, not request-time routing, and requires the application to build pages from `ssgParams` values sourced from untrusted origins such as a CMS, API, or user submissions.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-39408](https://security.snyk.io/vuln/SNYK-JS-HONO-15928833).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `hono` to version 4.13.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv)\n- [GitHub Commit](https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221)\n- [GitHub Release](https://github.com/honojs/hono/releases/tag/v4.13.5)\n",
"epssDetails": {
"percentile": "0.25298",
"probability": "0.00327",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84365"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-gqvv-2mrq-wpjv"
]
},
"packageName": "hono",
"proprietary": false,
"creationTime": "2026-09-02T13:51:25.812212Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T22:52:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:25.968012Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T11:52:47.378539Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"hono@4.13.0"
],
"upgradePath": [
false,
"hono@4.13.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "hono",
"version": "4.13.0"
},
{
"id": "SNYK-JS-HONO-19499091",
"title": "HTTP Request Smuggling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.13.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.13.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "hono",
"references": [
{
"url": "https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T11:49:49.276474Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T11:49:49.276474Z"
}
],
"description": "## Overview\n[hono](https://www.npmjs.org/package/hono) is an Ultrafast web framework for the Edges\n\nAffected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a `?` appearing after a `#` as the start of the query string. An attacker can smuggle parameters past upstream allow/deny lists and validation, poison cache entries with unobserved parameters, or achieve stored XSS in cached HTML, by placing query parameters after a `#` fragment so browsers, `new URL()`, and reverse proxies ignore them while the query helpers still read them. This requires a literal `#` in the request URL to reach the application, and deployments behind intermediaries that strip fragments or runtimes that normalize URLs, such as Cloudflare Workers, are unaffected.\n## Remediation\nUpgrade `hono` to version 4.13.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx)\n- [GitHub Commit](https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc)\n- [GitHub Release](https://github.com/honojs/hono/releases/tag/v4.13.5)\n",
"epssDetails": {
"percentile": "0.27272",
"probability": "0.00345",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84363"
],
"CWE": [
"CWE-444"
],
"GHSA": [
"GHSA-crvj-82cr-hjcx"
]
},
"packageName": "hono",
"proprietary": false,
"creationTime": "2026-09-02T14:13:53.444919Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T22:52:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:13:53.618953Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T11:49:49.276474Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"hono@4.13.0"
],
"upgradePath": [
false,
"hono@4.13.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "hono",
"version": "4.13.0"
},
{
"id": "SNYK-JS-HONO-19499068",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"credit": [
"Paco Cartones",
"Leon Marcos"
],
"semver": {
"vulnerable": [
"<4.13.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.13.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "hono",
"references": [
{
"url": "https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221",
"title": "GitHub Commit"
},
{
"url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T11:52:47.378539Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T11:52:47.378539Z"
}
],
"description": "## Overview\n[hono](https://www.npmjs.org/package/hono) is an Ultrafast web framework for the Edges\n\nAffected versions of this package are vulnerable to Directory Traversal in the `toSSG()` static site generation function, whose path normalization does not fully collapse runs of consecutive `..` segments and treats output directories that differ only in how they are rooted as equivalent. An attacker can cause build output to be written outside the intended output directory by supplying a route parameter with enough `..` sequences that reaches `ssgParams` from an untrusted source. \r\n\r\n**Note:** This affects build-time static site generation only, not request-time routing, and requires the application to build pages from `ssgParams` values sourced from untrusted origins such as a CMS, API, or user submissions.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-39408](https://security.snyk.io/vuln/SNYK-JS-HONO-15928833).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `hono` to version 4.13.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv)\n- [GitHub Commit](https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221)\n- [GitHub Release](https://github.com/honojs/hono/releases/tag/v4.13.5)\n",
"epssDetails": {
"percentile": "0.25298",
"probability": "0.00327",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84365"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-gqvv-2mrq-wpjv"
]
},
"packageName": "hono",
"proprietary": false,
"creationTime": "2026-09-02T13:51:25.812212Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T22:52:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:25.968012Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T11:52:47.378539Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"hono@4.13.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"hono@4.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "hono",
"version": "4.13.0"
},
{
"id": "SNYK-JS-HONO-19499091",
"title": "HTTP Request Smuggling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.13.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.13.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "hono",
"references": [
{
"url": "https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T11:49:49.276474Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T11:49:49.276474Z"
}
],
"description": "## Overview\n[hono](https://www.npmjs.org/package/hono) is an Ultrafast web framework for the Edges\n\nAffected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a `?` appearing after a `#` as the start of the query string. An attacker can smuggle parameters past upstream allow/deny lists and validation, poison cache entries with unobserved parameters, or achieve stored XSS in cached HTML, by placing query parameters after a `#` fragment so browsers, `new URL()`, and reverse proxies ignore them while the query helpers still read them. This requires a literal `#` in the request URL to reach the application, and deployments behind intermediaries that strip fragments or runtimes that normalize URLs, such as Cloudflare Workers, are unaffected.\n## Remediation\nUpgrade `hono` to version 4.13.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx)\n- [GitHub Commit](https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc)\n- [GitHub Release](https://github.com/honojs/hono/releases/tag/v4.13.5)\n",
"epssDetails": {
"percentile": "0.27272",
"probability": "0.00345",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84363"
],
"CWE": [
"CWE-444"
],
"GHSA": [
"GHSA-crvj-82cr-hjcx"
]
},
"packageName": "hono",
"proprietary": false,
"creationTime": "2026-09-02T14:13:53.444919Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T22:52:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:13:53.618953Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T11:49:49.276474Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"hono@4.13.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"hono@4.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "hono",
"version": "4.13.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.48",
"js-yaml@5.4.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.48",
"js-yaml@5.4.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"nanoid@5.1.6"
],
"upgradePath": [
false,
"node-llama-cpp@3.18.1",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.6"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:25:49.727372Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"nanoid@5.1.6"
],
"upgradePath": [
false,
"node-llama-cpp@3.18.1",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.6"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-15T14:03:28.067198Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-15T14:03:28.067198Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.08526",
"probability": "0.00187",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-15T14:03:28.067198Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "proxy-addr",
"version": "2.0.7"
},
{
"id": "SNYK-JS-SHARP-19653587",
"title": "Heap-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.35.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.35.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/releases/tag/v0.35.4",
"title": "GitHub Release"
},
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:39.720123Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:39.720123Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-122"
],
"GHSA": [
"GHSA-rgj7-g3m4-5g8c"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-09-09T13:56:44.366968Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-08T21:25:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T13:56:44.573106Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:39.720123Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"sharp@0.35.3"
],
"upgradePath": [
false,
"sharp@0.35.4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.3"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.16269",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:15:30.072805Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.16264",
"probability": "0.00248",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.736764Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635218",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Joshua Rogers"
],
"semver": {
"vulnerable": [
">=7.24.1 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation in the `BalancedPool` class, which deep-clones its `connect` and `tls` options with `JSON.parse(JSON.stringify(...))` and thereby silently drops any function-valued callbacks, such as a custom `checkServerIdentity` or connector, before they reach the TLS layer. An attacker can present a server certificate that the caller's custom `checkServerIdentity` was written to reject and still have it accepted, as long as it passes Node's default hostname and chain checks, because the discarded check never runs. This affects only `BalancedPool` configured with function-valued `connect` or `tls` options, and not `Client`, `Pool`, `Agent`, or `RoundRobinPool`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by using `Client`, `Pool`, or `Agent` instead of `BalancedPool` for connections that rely on a custom `checkServerIdentity` or connector, so the callback is not stripped before reaching the TLS layer.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96)\n",
"epssDetails": {
"percentile": "0.04263",
"probability": "0.00146",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84961"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-w293-vg96-wgc3"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:57:42.909930Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:57:43.156117Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737200Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.30373",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737978Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635226",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"krsecu"
],
"semver": {
"vulnerable": [
">=6.25.0 <6.28.1",
">=7.28.0 <7.29.1",
">=8.1.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in `lib/web/websocket/permessage-deflate.js`, whose cleanup calls `removeAllListeners()` on the zlib `InflateRaw` object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting `Z_DATA_ERROR` has no listener. This requires the application to use undici's WebSocket client or Node's bundled `globalThis.WebSocket` against an attacker-controlled or compromised WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6)\n",
"epssDetails": {
"percentile": "0.16981",
"probability": "0.00255",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85024"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-3wwx-pv8p-q78v"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:14:13.842408Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:14:14.076652Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T09:15:18.497837Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.16269",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:15:30.072805Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.16264",
"probability": "0.00248",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.736764Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635218",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Joshua Rogers"
],
"semver": {
"vulnerable": [
">=7.24.1 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation in the `BalancedPool` class, which deep-clones its `connect` and `tls` options with `JSON.parse(JSON.stringify(...))` and thereby silently drops any function-valued callbacks, such as a custom `checkServerIdentity` or connector, before they reach the TLS layer. An attacker can present a server certificate that the caller's custom `checkServerIdentity` was written to reject and still have it accepted, as long as it passes Node's default hostname and chain checks, because the discarded check never runs. This affects only `BalancedPool` configured with function-valued `connect` or `tls` options, and not `Client`, `Pool`, `Agent`, or `RoundRobinPool`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by using `Client`, `Pool`, or `Agent` instead of `BalancedPool` for connections that rely on a custom `checkServerIdentity` or connector, so the callback is not stripped before reaching the TLS layer.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96)\n",
"epssDetails": {
"percentile": "0.04263",
"probability": "0.00146",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84961"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-w293-vg96-wgc3"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:57:42.909930Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:57:43.156117Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737200Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.30373",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737978Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635226",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"krsecu"
],
"semver": {
"vulnerable": [
">=6.25.0 <6.28.1",
">=7.28.0 <7.29.1",
">=8.1.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in `lib/web/websocket/permessage-deflate.js`, whose cleanup calls `removeAllListeners()` on the zlib `InflateRaw` object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting `Z_DATA_ERROR` has no listener. This requires the application to use undici's WebSocket client or Node's bundled `globalThis.WebSocket` against an attacker-controlled or compromised WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6)\n",
"epssDetails": {
"percentile": "0.16981",
"probability": "0.00255",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85024"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-3wwx-pv8p-q78v"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:14:13.842408Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:14:14.076652Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T09:15:18.497837Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.0"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.16269",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:15:30.072805Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.16264",
"probability": "0.00248",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.736764Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635218",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Joshua Rogers"
],
"semver": {
"vulnerable": [
">=7.24.1 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation in the `BalancedPool` class, which deep-clones its `connect` and `tls` options with `JSON.parse(JSON.stringify(...))` and thereby silently drops any function-valued callbacks, such as a custom `checkServerIdentity` or connector, before they reach the TLS layer. An attacker can present a server certificate that the caller's custom `checkServerIdentity` was written to reject and still have it accepted, as long as it passes Node's default hostname and chain checks, because the discarded check never runs. This affects only `BalancedPool` configured with function-valued `connect` or `tls` options, and not `Client`, `Pool`, `Agent`, or `RoundRobinPool`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by using `Client`, `Pool`, or `Agent` instead of `BalancedPool` for connections that rely on a custom `checkServerIdentity` or connector, so the callback is not stripped before reaching the TLS layer.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96)\n",
"epssDetails": {
"percentile": "0.04263",
"probability": "0.00146",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84961"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-w293-vg96-wgc3"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:57:42.909930Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:57:43.156117Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737200Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.30373",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737978Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-UNDICI-19635226",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"krsecu"
],
"semver": {
"vulnerable": [
">=6.25.0 <6.28.1",
">=7.28.0 <7.29.1",
">=8.1.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in `lib/web/websocket/permessage-deflate.js`, whose cleanup calls `removeAllListeners()` on the zlib `InflateRaw` object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting `Z_DATA_ERROR` has no listener. This requires the application to use undici's WebSocket client or Node's bundled `globalThis.WebSocket` against an attacker-controlled or compromised WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6)\n",
"epssDetails": {
"percentile": "0.16981",
"probability": "0.00255",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85024"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-3wwx-pv8p-q78v"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:14:13.842408Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:14:14.076652Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T09:15:18.497837Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.0"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498556",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
"<0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.1,
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:32.808776Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.808776Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via improper validation of the `name` property in the DocumentType node when `requireWellFormed` is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the `name` property, potentially leading to the injection of sibling elements or manipulation of the document structure.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27667",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83608"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-27p8-2357-5qqv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:15:37.574840Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:07.252000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:15:37.769617Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:32.808776Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498558",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:22.846788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.846788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `parseFromString` function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n",
"epssDetails": {
"percentile": "0.22322",
"probability": "0.00301",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83619"
],
"CWE": [
"CWE-1333",
"CWE-770"
],
"GHSA": [
"GHSA-x4fp-j954-r2f4"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:20:22.704604Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:17.721000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:20:22.887546Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:22.846788Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499069",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Eric Chiang"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:29.938727Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:29.938727Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `appendElement` function in `lib/sax.js` when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27942",
"probability": "0.00351",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83615"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-965w-775f-mr7g"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:51:45.992466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:19.598000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:46.181381Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:29.938727Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499070",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"credit": [
"bhaswanthc",
"Arpit Jain"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.8,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "4.0",
"modificationTime": "2026-09-04T06:32:47.128081Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:47.128081Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the `Document.createProcessingInstruction` function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27622",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83616"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-c7q8-3ch8-vqpv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:53:54.689728Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:22.960000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:53:54.963551Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-04T06:32:47.128081Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499072",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-04T14:04:18.083950Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T14:04:18.083950Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `DOMParser.parseFromString` function. An attacker can cause significant performance degradation and stall the `Node.js` event loop by submitting XML documents containing elements with a large number of unique attributes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27215",
"probability": "0.00344",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83613"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-8344-3jmq-59r6"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:57:02.117445Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:40.823000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:57:02.390463Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-04T14:04:18.083950Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499075",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:28.153407Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:28.153407Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createElement` method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.27622",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83607"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-w2rr-34g9-rvrj"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:04:54.123458Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:12.638000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:04:54.343649Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:28.153407Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499076",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:06:36.520283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:06:36.520283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseElementStartPart` function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27942",
"probability": "0.00351",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83614"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-93r5-fhx6-vmg9"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:06:36.247967Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:45.685000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:06:36.425334Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:06:36.520283Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499081",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:09:11.515189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:09:11.515189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `setAttribute` method. An attacker can inject arbitrary attribute names, including those containing event handlers or namespace declarations, by supplying crafted input that bypasses validation checks.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.27667",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83605"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-4w3w-2rp5-g8jm"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:09:11.124280Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:18.042000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:09:11.380629Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:09:11.515189Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.13"
}
],
"ok": false,
"dependencyCount": 490,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "54 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-FASTURI-18506908",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"alanturing881"
],
"semver": {
"vulnerable": [
"<2.4.4",
">=3.0.0 <3.1.5",
">=4.0.0 <4.1.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.4",
"3.1.5",
"4.1.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-23T15:25:44.164672Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:05:10.984006Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in `parseWithStatus()` and `resolve()` in `index.js`. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses `\\\\`, `/\\\\`, or `\\\\/` in place of `//` after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG `URL` treats them as a real authority on special schemes such as `http`, `https`, `ws`, `wss`, `ftp`, and `file`. Applications that validate a URL with `fast-uri` and then pass the same input to `fetch()`, `undici`, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.\n## Remediation\nUpgrade `fast-uri` to version 2.4.4, 3.1.5, 4.1.2 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7)\n",
"epssDetails": {
"percentile": "0.12820",
"probability": "0.00221",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18446"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-7p8r-x3mc-p8w7"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-02T09:20:09.869725Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T17:55:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T09:20:10.035273Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-23T15:25:44.164672Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.4"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.48",
"js-yaml@5.4.2"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "js-yaml",
"version": "4.3.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.48",
"js-yaml@5.4.2"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "js-yaml",
"version": "4.3.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"nanoid@5.1.6"
],
"upgradePath": [
false,
"node-llama-cpp@3.18.1",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "nanoid",
"version": "5.1.6",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:25:49.727372Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"nanoid@5.1.6"
],
"upgradePath": [
false,
"node-llama-cpp@3.18.1",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "nanoid",
"version": "5.1.6",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-15T14:03:28.067198Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-15T14:03:28.067198Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.08526",
"probability": "0.00187",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-15T14:03:28.067198Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "proxy-addr",
"version": "2.0.7",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:15:30.072805Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.16269",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:15:30.072805Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.736764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.16264",
"probability": "0.00248",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.736764Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635218",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Joshua Rogers"
],
"semver": {
"vulnerable": [
">=7.24.1 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:27.044132Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.339082Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation in the `BalancedPool` class, which deep-clones its `connect` and `tls` options with `JSON.parse(JSON.stringify(...))` and thereby silently drops any function-valued callbacks, such as a custom `checkServerIdentity` or connector, before they reach the TLS layer. An attacker can present a server certificate that the caller's custom `checkServerIdentity` was written to reject and still have it accepted, as long as it passes Node's default hostname and chain checks, because the discarded check never runs. This affects only `BalancedPool` configured with function-valued `connect` or `tls` options, and not `Client`, `Pool`, `Agent`, or `RoundRobinPool`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by using `Client`, `Pool`, or `Agent` instead of `BalancedPool` for connections that rely on a custom `checkServerIdentity` or connector, so the callback is not stripped before reaching the TLS layer.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96)\n",
"epssDetails": {
"percentile": "0.04263",
"probability": "0.00146",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84961"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-w293-vg96-wgc3"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:57:42.909930Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:57:43.156117Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737200Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:07.737978Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.30373",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:07.737978Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635226",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"krsecu"
],
"semver": {
"vulnerable": [
">=6.25.0 <6.28.1",
">=7.28.0 <7.29.1",
">=8.1.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T09:15:18.497837Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:03:13.051185Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in `lib/web/websocket/permessage-deflate.js`, whose cleanup calls `removeAllListeners()` on the zlib `InflateRaw` object, removing the error listener while the stream is still active. An attacker can crash the Node.js process, and repeat the crash on every reconnect to form a crash loop, by sending a permessage-deflate WebSocket message of roughly 130 KB that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block, so the resulting `Z_DATA_ERROR` has no listener. This requires the application to use undici's WebSocket client or Node's bundled `globalThis.WebSocket` against an attacker-controlled or compromised WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6)\n",
"epssDetails": {
"percentile": "0.16981",
"probability": "0.00255",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85024"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-3wwx-pv8p-q78v"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:14:13.842408Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:14:14.076652Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T09:15:18.497837Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498556",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
"<0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.1,
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:32.808776Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.808776Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via improper validation of the `name` property in the DocumentType node when `requireWellFormed` is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the `name` property, potentially leading to the injection of sibling elements or manipulation of the document structure.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27667",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83608"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-27p8-2357-5qqv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:15:37.574840Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:07.252000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:15:37.769617Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:32.808776Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498558",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:22.846788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.846788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `parseFromString` function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n",
"epssDetails": {
"percentile": "0.22322",
"probability": "0.00301",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83619"
],
"CWE": [
"CWE-1333",
"CWE-770"
],
"GHSA": [
"GHSA-x4fp-j954-r2f4"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:20:22.704604Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:17.721000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:20:22.887546Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:22.846788Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499069",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Eric Chiang"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:29.938727Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:29.938727Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `appendElement` function in `lib/sax.js` when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27942",
"probability": "0.00351",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83615"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-965w-775f-mr7g"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:51:45.992466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:19.598000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:46.181381Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:29.938727Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499070",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"credit": [
"bhaswanthc",
"Arpit Jain"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.8,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "4.0",
"modificationTime": "2026-09-04T06:32:47.128081Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:47.128081Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the `Document.createProcessingInstruction` function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27622",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83616"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-c7q8-3ch8-vqpv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:53:54.689728Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:22.960000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:53:54.963551Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-04T06:32:47.128081Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499072",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-04T14:04:18.083950Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T14:04:18.083950Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `DOMParser.parseFromString` function. An attacker can cause significant performance degradation and stall the `Node.js` event loop by submitting XML documents containing elements with a large number of unique attributes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27215",
"probability": "0.00344",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83613"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-8344-3jmq-59r6"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:57:02.117445Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:40.823000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:57:02.390463Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-04T14:04:18.083950Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499075",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T07:56:28.153407Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:28.153407Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createElement` method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.27622",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83607"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-w2rr-34g9-rvrj"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:04:54.123458Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:12.638000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:04:54.343649Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T07:56:28.153407Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499076",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:06:36.520283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:06:36.520283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseElementStartPart` function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.27942",
"probability": "0.00351",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83614"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-93r5-fhx6-vmg9"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:06:36.247967Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:45.685000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:06:36.425334Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:06:36.520283Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499081",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:09:11.515189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:09:11.515189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `setAttribute` method. An attacker can inject arbitrary attribute names, including those containing event handlers or namespace declarations, by supplying crafted input that bypasses validation checks.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.27667",
"probability": "0.00348",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83605"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-4w3w-2rp5-g8jm"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:09:11.124280Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:18.042000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:09:11.380629Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:09:11.515189Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.13"
],
"upgradePath": [
false,
"mammoth@1.12.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.13",
"severityWithCritical": "high"
}
],
"upgrade": {
"hono@4.13.0": {
"upgradeTo": "hono@4.13.5",
"upgrades": [
"hono@4.13.0",
"hono@4.13.0"
],
"vulns": [
"SNYK-JS-HONO-19499068",
"SNYK-JS-HONO-19499091"
]
},
"html-to-text@9.0.5": {
"upgradeTo": "html-to-text@10.0.0",
"upgrades": [
"deepmerge@4.3.1"
],
"vulns": [
"SNYK-JS-DEEPMERGE-19964053"
]
},
"sharp@0.35.3": {
"upgradeTo": "sharp@0.35.4",
"upgrades": [
"sharp@0.35.3"
],
"vulns": [
"SNYK-JS-SHARP-19653587"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 30,
"targetFile": "/opt/scopear/app/services/ai-server/package.json",
"projectName": "server",
"displayTargetFile": "/opt/scopear/app/services/ai-server/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.50.21_47ddc85.4286"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/app/node_modules",
"projectName": "app",
"displayTargetFile": "/opt/scopear/app/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.50.21_47ddc85.4286"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.35497",
"probability": "0.00415",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24.991000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:21.705388Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/jest@29.5.14",
"expect@29.7.0",
"jest-message-util@29.7.0",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@types/jest@30.0.0",
"expect@30.5.2",
"jest-message-util@30.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.35497",
"probability": "0.00415",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24.991000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:21.705388Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@typescript-eslint/parser@5.62.0",
"@typescript-eslint/typescript-estree@5.62.0",
"globby@11.1.0",
"fast-glob@3.3.3",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@typescript-eslint/parser@8.3.0",
"@typescript-eslint/typescript-estree@8.3.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.35497",
"probability": "0.00415",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24.991000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:21.705388Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@typescript-eslint/eslint-plugin@5.62.0",
"@typescript-eslint/utils@5.62.0",
"@typescript-eslint/typescript-estree@5.62.0",
"globby@11.1.0",
"fast-glob@3.3.3",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@typescript-eslint/eslint-plugin@8.3.0",
"@typescript-eslint/utils@8.3.0",
"@typescript-eslint/typescript-estree@8.3.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.35497",
"probability": "0.00415",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24.991000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:21.705388Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@typescript-eslint/eslint-plugin@5.62.0",
"@typescript-eslint/type-utils@5.62.0",
"@typescript-eslint/typescript-estree@5.62.0",
"globby@11.1.0",
"fast-glob@3.3.3",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@typescript-eslint/eslint-plugin@8.3.0",
"@typescript-eslint/type-utils@8.3.0",
"@typescript-eslint/typescript-estree@8.3.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.705388Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.35497",
"probability": "0.00415",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24.991000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:21.705388Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@typescript-eslint/eslint-plugin@5.62.0",
"@typescript-eslint/type-utils@5.62.0",
"@typescript-eslint/utils@5.62.0",
"@typescript-eslint/typescript-estree@5.62.0",
"globby@11.1.0",
"fast-glob@3.3.3",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@typescript-eslint/eslint-plugin@8.3.0",
"@typescript-eslint/type-utils@8.3.0",
"@typescript-eslint/utils@8.3.0",
"@typescript-eslint/typescript-estree@8.3.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.31654",
"probability": "0.00391",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-24T14:06:06.638835Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-IMAGESIZE-17295814",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<2.0.3"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"2.0.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:02.754145Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:02.754145Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nUpgrade `image-size` to version 2.0.3 or higher.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71329"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:39:40.827383Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:17Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:39:40.987645Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:02.754145Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [
false,
"image-size@2.0.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "image-size",
"version": "2.0.2"
},
{
"id": "SNYK-JS-IMAGESIZE-17295816",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<2.0.3"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"2.0.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-17T02:01:02.754603Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T02:01:02.754603Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nUpgrade `image-size` to version 2.0.3 or higher.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71330"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:43:12.039483Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:43:12.497488Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-17T02:01:02.754603Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [
false,
"image-size@2.0.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "image-size",
"version": "2.0.2"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:25:49.727372Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid@5.1.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid-cjs@0.0.7",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid-cjs@0.0.7",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:25:49.727372Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:25:49.727372Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid-cjs@0.0.7",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid-cjs@0.0.7",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-15T14:03:28.067198Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-15T14:03:28.067198Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.08526",
"probability": "0.00187",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-15T14:03:28.067198Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "proxy-addr",
"version": "2.0.7"
},
{
"id": "SNYK-JS-SHARP-19653587",
"title": "Heap-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.35.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.35.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/releases/tag/v0.35.4",
"title": "GitHub Release"
},
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:39.720123Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:39.720123Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-122"
],
"GHSA": [
"GHSA-rgj7-g3m4-5g8c"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-09-09T13:56:44.366968Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-08T21:25:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T13:56:44.573106Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:39.720123Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"sharp@0.35.3"
],
"upgradePath": [
false,
"sharp@0.35.4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.3"
},
{
"id": "SNYK-JS-URIJS-19963963",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "uri-js",
"references": [
{
"url": "https://github.com/garycourt/uri-js/issues/105",
"title": "GitHub Issue"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L349",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L352-L376",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"description": "## Overview\n[uri-js](https://github.com/garycourt/uri-js) is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.\n\nAffected versions of this package are vulnerable to Infinite loop via the `removeDotSegments` function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to `removeDotSegments` directly, or through the `normalize` or `resolve` functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.\n## Remediation\nThere is no fixed version for `uri-js`.\n## References\n- [GitHub Issue](https://github.com/garycourt/uri-js/issues/105)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376)\n",
"epssDetails": {
"percentile": "0.38931",
"probability": "0.00457",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93690"
],
"CWE": [
"CWE-835"
]
},
"packageName": "uri-js",
"proprietary": false,
"creationTime": "2026-09-20T09:04:44.397511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:20.329000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:04:44.578622Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:51.544109Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/eslintrc@2.1.4",
"ajv@6.14.0",
"uri-js@4.4.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "uri-js",
"version": "4.4.1"
},
{
"id": "SNYK-JS-URIJS-19963963",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "uri-js",
"references": [
{
"url": "https://github.com/garycourt/uri-js/issues/105",
"title": "GitHub Issue"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L349",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L352-L376",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"description": "## Overview\n[uri-js](https://github.com/garycourt/uri-js) is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.\n\nAffected versions of this package are vulnerable to Infinite loop via the `removeDotSegments` function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to `removeDotSegments` directly, or through the `normalize` or `resolve` functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.\n## Remediation\nThere is no fixed version for `uri-js`.\n## References\n- [GitHub Issue](https://github.com/garycourt/uri-js/issues/105)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376)\n",
"epssDetails": {
"percentile": "0.38931",
"probability": "0.00457",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93690"
],
"CWE": [
"CWE-835"
]
},
"packageName": "uri-js",
"proprietary": false,
"creationTime": "2026-09-20T09:04:44.397511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:20.329000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:04:44.578622Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:51.544109Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"ajv@6.14.0",
"uri-js@4.4.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "uri-js",
"version": "4.4.1"
},
{
"id": "SNYK-JS-URIJS-19963963",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "uri-js",
"references": [
{
"url": "https://github.com/garycourt/uri-js/issues/105",
"title": "GitHub Issue"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L349",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L352-L376",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.544109Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"description": "## Overview\n[uri-js](https://github.com/garycourt/uri-js) is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.\n\nAffected versions of this package are vulnerable to Infinite loop via the `removeDotSegments` function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to `removeDotSegments` directly, or through the `normalize` or `resolve` functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.\n## Remediation\nThere is no fixed version for `uri-js`.\n## References\n- [GitHub Issue](https://github.com/garycourt/uri-js/issues/105)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376)\n",
"epssDetails": {
"percentile": "0.38931",
"probability": "0.00457",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93690"
],
"CWE": [
"CWE-835"
]
},
"packageName": "uri-js",
"proprietary": false,
"creationTime": "2026-09-20T09:04:44.397511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:20.329000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:04:44.578622Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-23T05:40:51.544109Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"@eslint/eslintrc@2.1.4",
"ajv@6.14.0",
"uri-js@4.4.1"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "uri-js",
"version": "4.4.1"
}
],
"ok": false,
"dependencyCount": 899,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "610 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.2",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.2",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "deepmerge",
"version": "4.3.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.31654",
"probability": "0.00391",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-24T14:06:06.638835Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-15T14:03:28.067198Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-15T14:03:28.067198Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.08526",
"probability": "0.00187",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-15T14:03:28.067198Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "proxy-addr",
"version": "2.0.7",
"severityWithCritical": "critical"
}
],
"upgrade": {
"@types/jest@29.5.14": {
"upgradeTo": "@types/jest@30.0.0",
"upgrades": [
"braces@3.0.3"
],
"vulns": [
"SNYK-JS-BRACES-19963945"
]
},
"@typescript-eslint/eslint-plugin@5.62.0": {
"upgradeTo": "@typescript-eslint/eslint-plugin@8.3.0",
"upgrades": [
"braces@3.0.3"
],
"vulns": [
"SNYK-JS-BRACES-19963945"
]
},
"@typescript-eslint/parser@5.62.0": {
"upgradeTo": "@typescript-eslint/parser@8.3.0",
"upgrades": [
"braces@3.0.3"
],
"vulns": [
"SNYK-JS-BRACES-19963945"
]
},
"eslint@8.57.1": {
"upgradeTo": "eslint@10.0.0",
"upgrades": [
"js-yaml@4.3.0",
"js-yaml@4.3.0",
"uri-js@4.4.1"
],
"vulns": [
"SNYK-JS-JSYAML-18593780",
"SNYK-JS-JSYAML-19496768",
"SNYK-JS-URIJS-19963963"
]
},
"image-size@2.0.2": {
"upgradeTo": "image-size@2.0.3",
"upgrades": [
"image-size@2.0.2",
"image-size@2.0.2"
],
"vulns": [
"SNYK-JS-IMAGESIZE-17295814",
"SNYK-JS-IMAGESIZE-17295816"
]
},
"nanoid@5.1.7": {
"upgradeTo": "nanoid@5.1.16",
"upgrades": [
"nanoid@5.1.7",
"nanoid@5.1.7"
],
"vulns": [
"SNYK-JS-NANOID-18506894",
"SNYK-JS-NANOID-18748186"
]
},
"sharp@0.35.3": {
"upgradeTo": "sharp@0.35.4",
"upgrades": [
"sharp@0.35.3"
],
"vulns": [
"SNYK-JS-SHARP-19653587"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 15,
"targetFile": "/opt/scopear/app/services/node_modules",
"projectName": "services",
"displayTargetFile": "/opt/scopear/app/services/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.50.21_47ddc85.4286"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/.npm-global/lib/node_modules",
"projectName": "lib",
"displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.50.21_47ddc85.4286"
}
]
}