Regular Expression Denial of Service in browserslist

MEDIO 5.3CVE-2021-23364 · GHSA-w8qv-6jwh-64r5 · Published 28/04/2021 · updated 17/06/2026

In breve

CVE-2021-23364 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda browserslist (browserslist project), browserslist.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.4%, superiore al 84.0% delle vulnerabilità.
Correzione: aggiornare a 4.16.5 o successiva.

Package	Affected versions	Patched versions
browserslist browserslist_project	`≥ 4.0.0, < 4.16.5`	`4.16.5`
browserslist npm	`≥ 4.0.0, < 4.16.5`	`4.16.5`

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

NVD description

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.