CVE-2026-73089
HighAdvisory
Published 11 Aug 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 246
- of 17,781 indexed, latest versions
- Container images
- 248
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Carried by container images the latest versions of 246 of 17,781 indexed charts deploy, on 248 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| browserslistnpm | 0.4.0, 1.7.7, 2.11.3, 3.2.8+52 more | 4.28.7 | 248 |
| node-browserslistdeb | 4.22.1+~cs6.1.28-1 | no fix listed | 1 |
- OSV records
- GHSA-c83g-rgw3-j3cxUBUNTU-CVE-2026-73089
Charts affected
246 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| mongo-expresscowboysysopVerified publisher | 7.0.0 | 1 of 1See more | 1,210 |
| difydoubanVerified publisher | 0.10.0 | 1 of 6See more | 19,391 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 7,210 |
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| outlineoutline | 0.0.9 | 1 of 4See more | 4,431 |
| outlinekubitodevVerified publisher | 1.2.2 | 1 of 4See more | 5,352 |
| servarrkubitodevVerified publisher | 1.5.2 | 1 of 10See more | 3,004 |
| supabasetokens-studioVerified publisher | 1.0.0 | 1 of 14See more | 23,123 |
| wekanwekanVerified publisher | 11.76.0 | 1 of 3See more | 1,576 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 10,775 |
| syftopenmined | 0.9.5 | 1 of 6See more | 17,245 |
| redisinsightheywood8-helm-chartsVerified publisher | 0.4.5 | 1 of 1See more | 2,828 |
| servarrservarr | 1.0.2 | 1 of 10See more | 14,238 |
| misskeyalytiVerified publisher | 1.0.0 | 1 of 1See more | 5,251 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 5,946 |
| klusterviewklusterviewVerified publisher | 0.1.0 | 1 of 4See more | 3,795 |
| librechatlibrechat | 1.8.10 | 1 of 3See more | 2,654 |
| headplanenbcloudVerified publisher | 0.1.2 | 1 of 4See more | 7,949 |
| open5gsopen5gsVerified publisher | 2.3.4 | 1 of 5See more | 9,261 |
| codetogethercodetogether | 1.4.25 | 1 of 1See more | 7,450 |
| community-solid-servercommunity-solid-server | 3.0.0 | 1 of 1See more | 1,613 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 2 of 10See more | 28,839 |
| hoppscotchdeliveryheroVerified publisher | 0.3.2 | 1 of 1See more | 3,451 |
| duplistatusduplistatusVerified publisher | 1.2.0 | 1 of 2See more | 1,870 |
| nightscoutgabe565Verified publisher | 0.13.0 | 1 of 2See more | 2,521 |
| calibregeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 22,773 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 7,579 |
| graphql-hivegraphql-hive | 1.0.0 | 1 of 17See more | 10,311 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 1 of 15See more | 30,816 |
| flagsmithone-acre-fundVerified publisher | 0.1.5 | 1 of 6See more | 6,868 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 1 of 9See more | 18,517 |
| overseerrpree-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,702 |
| browserless-chromesagikazarmarkVerified publisher | 0.0.5 | 1 of 1See more | 24,488 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 1 of 10See more | 28,534 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,044 |
| hermes-agentankra-chartsVerified publisher | 0.3.1 | 1 of 1See more | 5,880 |
| soarv113assist-iot-cybersecurity-monitoring-soar | 0.1.3 | 1 of 5See more | 17,896 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 38,346 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| enbuildenbuildVerified publisher | 0.0.50 | 3 of 6See more | 31,510 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 1,442 |
| overseerrgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,444 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 7,801 |
| growthbookgrowthbook | 5.0.1 | 1 of 2See more | 709 |
| todo-appjunktext-direct | 1.1.4 | 1 of 1See more | 3,369 |
Container images carrying it
248 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| leonardomulticloud/ | e42a341e0299 | browserslist | 4.28.7 | 1 |
| library/ | 1aae00775251 | browserslist | 4.28.7 | 1 |
| linuxserver/ | a847b5b2d860 | browserslist | 4.28.7 | 1 |
| linuxserver/ | b801bbcf6386 | browserslist | 4.28.7 | 1 |
| linuxserver/ | 6108ed066d4a | browserslist | 4.28.7 | 1 |
| lissy93/ | 1991f7be5ed0 | browserslist | 4.28.7 | 1 |
| loftsh/ | 25deb9bd2683 | browserslist | 4.28.7 | 1 |
| lsstsqre/ | 9ded78e7fe03 | browserslist | 4.28.7 | 1 |
| ltdstudio/ | 0e76c6f4eac0 | browserslist | 4.28.7 | 1 |
| mautic/ | eb8cc73d97e1 | browserslist | 4.28.7 | 1 |
| mintproject/ | 222e3b941a36 | browserslist | 4.28.7 | 1 |
| misskey/ | e08b7c478093 | browserslist | 4.28.7 | 1 |
| mitchxxx/ | 4e72480ec63a | browserslist | 4.28.7 | 1 |
| moreillon/ | 3739ef6956b5 | browserslist | 4.28.7 | 1 |
| moreillon/ | d7d4a5463525 | browserslist | 4.28.7 | 1 |
| moreillon/ | c1072f4ab6aa | browserslist | 4.28.7 | 1 |
| moreillon/ | e8fd856e593d | browserslist | 4.28.7 | 1 |
| moreillon/ | 3caa8f710ee0 | browserslist | 4.28.7 | 1 |
| moreillon/ | d2ee0423b797 | browserslist | 4.28.7 | 1 |
| mozilla/ | 1da6ff5c4895 | browserslist | 4.28.7 | 1 |
| nightscout/ | 00c3b4833f1b | browserslist | 4.28.7 | 1 |
| nightscout/ | ad29ca7a4de6 | browserslist | 4.28.7 | 1 |
| nightscout/ | f604dc4c03ca | browserslist | 4.28.7 | 1 |
| nocodb/ | d9516f0bf546 | browserslist | 4.28.7 | 1 |
| nousresearch/ | e0df6adebddf | browserslist | 4.28.7 | 1 |
| obolnetwork/ | e263be0a7440 | browserslist | 4.28.7 | 1 |
| ondrejsika/ | b1fd497416c8 | browserslist | 4.28.7 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | browserslist | 4.28.7 | 1 |
| opea/ | 2bee4eb66f3e | browserslist | 4.28.7 | 1 |
| opea/ | 3ef121f34610 | browserslist | 4.28.7 | 1 |
| opea/ | 7f854e9bffaf | browserslist | 4.28.7 | 1 |
| openbas/ | a277796d9724 | browserslist | 4.28.7 | 1 |
| openhab/ | 29dd2bac8c4b | browserslist | 4.28.7 | 1 |
| openmined/ | d11524a3854a | browserslist | 4.28.7 | 1 |
| oryd/ | d454c21c11bc | browserslist | 4.28.7 | 1 |
| outlinewiki/ | 494dfb9249a6 | browserslist | 4.28.7 | 1 |
| parithoshj/ | cdca426fea6d | browserslist | 4.28.7 | 1 |
| phntom/ | 1b9aafbb62e6 | browserslist | 4.28.7 | 1 |
| pysga1996/ | fdeec30ad482 | browserslist | 4.28.7 | 1 |
| rahulbhiwagade122/ | 08490b70998c | browserslist | 4.28.7 | 1 |
| requarks/ | 8b5865a7386c | browserslist | 4.28.7 | 1 |
| rocketadmin/ | 10955ef540b9 | browserslist | 4.28.7 | 1 |
| safeglobal/ | 12ccfd93fcaf | browserslist | 4.28.7 | 1 |
| samajh/ | 05ef4fddbb75 | browserslist | 4.28.7 | 1 |
| shahanafarooqui/ | d0cd3d868aca | browserslist | 4.28.7 | 1 |
| sharanalwar/ | 5e82950b16b7 | browserslist | 4.28.7 | 1 |
| sigp/ | 2c219b04758e | browserslist | 4.28.7 | 1 |
| siscc/ | b6f9a7c888fc | browserslist | 4.28.7 | 1 |
| socialmediamacroscope/ | c5095e94bc65 | browserslist | 4.28.7 | 1 |
| solidproject/ | ccc4acb7e9a1 | browserslist | 4.28.7 | 1 |