What’s Vulnerable › Vulnerabilities

CVE-2021-23364: Regular Expression Denial of Service (ReDoS)

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-28 · updated 2026-06-17
• Weakness: CWE-1333

Description

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Affected products

• browserslist: from 4.0.0 before 4.16.5 — fixed in 4.16.5
• Npm Browserslist: from 4.0.0 before 4.16.5 — fixed in 4.16.5

How to fix

Upgrade to a fixed version: browserslist 4.16.5; Npm Browserslist 4.16.5. Check the vendor advisory for mitigations.

References

• https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474
• https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98
• https://github.com/browserslist/browserslist/pull/593
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182
• https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
• https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474
• https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98
• https://github.com/browserslist/browserslist/pull/593
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182
• https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194

Get alerted when CVE-2021-23364 or the next vulnerability affects your stack