GHSA-w5vr-8v7q-w6rv CVE-2026-45819
baseline-browser-mapping process termination on invalid input causes denial of service
- Severity
- 6.6 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.51%
- Chance of exploitation in the next 30 days. Higher than 43.26% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-705 Incorrect Control Flow Scoping
- Fix
2.11.0- Upgrade baseline-browser-mapping to this version or later
Description
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| baseline-browser-mapping | >= 2.0.0, < 2.11.0 |
2.11.0 |
| baseline-browser-mapping | >= 2.0.0, < 2.11.0 |
2.11.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
baseline-browser-mapping npm → 2.11.0
- npm
npm install baseline-browser-mapping@2.11.0- yarn
yarn add baseline-browser-mapping@2.11.0- pnpm
pnpm add baseline-browser-mapping@2.11.0
Severity breakdown
CVSS 4.0 6.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
- Scope
- N
Weakness
CWE-705: Incorrect Control Flow Scoping
The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rg5q-pp8p-f7jm PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 | High | Same weakness, CWE-705 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor