browserslist (npm)
🦔 Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-preset-env
Advisories
5
Latest version
4.29.5
Released Oct 26, 2026
License
MIT
OpenSSF Scorecard
6.5 / 10
How to fix
Upgrading to 4.28.7 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install browserslist@4.29.5yarn
yarn add browserslist@4.29.5pnpm
pnpm add browserslist@4.29.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-c83g-rgw3-j3cx Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
High EPSS 0.66% |
< 4.28.7 | 4.28.7 |
| GHSA-c83g-rgw3-j3cx Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
High EPSS 0.66% |
<= 4.28.6 | No fix yet |
| GHSA-73wf-gq98-2v4g Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
High EPSS 0.66% |
< 4.28.7 | 4.28.7 |
| GHSA-73wf-gq98-2v4g Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
High EPSS 0.66% |
<= 4.28.6 | No fix yet |
| GHSA-w8qv-6jwh-64r5 Regular Expression Denial of Service in browserslist |
Medium EPSS 2.38% |
>= 4.0.0, < 4.16.5 | 4.16.5 |
Source: git+https://github.com/browserslist/browserslist.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor