Browserslist, a configuration tool that shares browser targeting data among front‑end build tools, contains a memory exhaustion flaw. Prior to version 4.28.7 the library keeps every distinct (queries, context) result and every parseQueries() abstract syntax tree in memory without any size cap, TTL, or eviction policy. This flaw, identified as CWE‑770, permits an attacker who can influence the browserslist() query values to trigger linear growth of the internal cache until the host process runs out of memory and crashes, resulting in a denial‑of‑service condition.

This vulnerability affects all public releases of browserslist up to and including 4.28.6, which are commonly embedded in front‑end build pipelines such as Webpack, Rollup, and Babel. The issue is resolved in browserslist 4.28.7, which introduces a bounded cache and eviction policy to prevent excessive memory usage.

The CVSS score of 7.5 reflects a high severity risk, but the EPSS score of less than 1% indicates that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector does not rely on network access; instead, it requires an attacker who can supply repeated browserslist() queries—such as a malicious user feeding custom version strings or a CI pipeline that processes untrusted configuration files—to force the cache to expand and eventually exhaust system memory.