ROOT-APP-NPM-CVE-2026-73089 CVE-2026-73089 in browserslist - Patched by Root

Root has patched CVE-2026-73089 in the browserslist package for Root:npm. Multiple fixed versions available...

CVE-2026-73089 vulnerabilities

Vulnerabilities for packages: authentik, wazuh-dashboard, langfuse, gitlab-rails-ce, nextcloud-server, wazuh-dashboard-fips, gitlab-rails-ce-fips, langfuse-fips, jupyter-base-notebook, ts-patch, kubeflow-katib, authentik-fips, tensorflow-gpu-jupyter, commercial-gitlab-rails-ee-fips, vitess,...

CVE-2026-73089 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, vitess, langfuse, kubeflow-katib, argo-workflows, ts-patch...

CVE-2026-73089

creationtimestamp| type| source ---|---|--- 2026-09-01 18:35:04+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-c83g-rgw3-j3cx 2026-09-05 16:13:11+00:00| seen| https://gist.github.com/djlan/e3b6762435f262eb64ea25ec3f8c9d82 2026-09-05 16:19:59+00:00| seen|...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +19386 more potentially affected by CVE-2026-73089 via browserslist (>=4.0.0, <=4.28.6)

browserslist NPM version =4.0.0, =1.0.1, =1.1.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0...

Security update for python-pytest-html (important)

openSUSE security update: security update for python-pytest-html ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21602-1 Rating: important References: bsc1275374 bsc1275437 Cross-References: CVE-2026-73088 CVE-2026-73089 CVSS scores: CVE-2026-73088...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +19386 more potentially affected by CVE-2026-73089 via browserslist (>=4.0.0, <=4.28.6)

browserslist NPM version =4.0.0, =1.0.1, =1.1.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.8-0.1.1.hum1 aarch64, x8664 grafana12.4-12.4.8-0.1.1.hum1.src src Security Fixes: grafana12.4: CVE-2026-73086 CVE-2026-73088 CVE-2026-73089...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.3-0.1.1.hum1 aarch64, x8664 grafana13.1-13.1.3-0.1.1.hum1.src src Security Fixes: grafana13.1: CVE-2026-73088 CVE-2026-73089...

CVE-2026-73089

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

DEBIAN-CVE-2026-73089

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

CVE-2026-73089

CVE-2026-73089 affects Browserslist: prior to 4.28.7, index.js caches every distinct (queries, context) result and every parseQueries() AST in parseCache without a size cap, TTL, or eviction. An attacker who can influence repeated browserslist() query values (including those in the form --) can b...