The baseline-browser-mapping package for Node.js, versions 2.x prior to 2.11.0, incorrectly calls process.exit() when receiving invalid or conflicting input parameters instead of throwing an error. This causes the entire Node.js process to terminate immediately, leading to a denial of service. The vulnerability is tied to input validation weaknesses identified as CWE-617, CWE-705, and resource exhaustion failures identified as CWE-755.

Users of the baseline-browser-mapping npm package who have installed a vulnerable version (any 2.x before 2.11.0). The package is used in web platform code that maps browser capabilities and may be embedded in server‑side applications that handle user input or external data.

The CVSS score of 6.6 indicates moderate severity with potential for widespread impact in applications that rely on the library. The EPSS score is 0.00371 (approximately 0.37%), and the vulnerability is not listed in CISA's KEV catalog, suggesting no known exploitation campaigns against this specific flaw. However, the attack vector is inferred to be local or remote depending on whether the library processes data supplied by untrusted sources. An attacker who can influence the input parameters could trigger an immediate shutdown of the hosting process, disrupting service availability.