MEDIUM
GHSA-w5vr-8v7q-w6rv
baseline-browser-mapping process termination on invalid input causes denial of service
Quick fix
GHSA-w5vr-8v7q-w6rv — baseline-browser-mapping: upgrade to the fixed version with the command below.
npm install baseline-browser-mapping@2.11.0Details
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/baseline-browser-mapping
Introduced in:
2.0.0Fixed in: 2.11.0Fix
npm install baseline-browser-mapping@2.11.0References
- https://nvd.nist.gov/vuln/detail/CVE-2026-45819[ADVISORY]
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137[WEB]
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519[WEB]
- https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589[WEB]
- https://github.com/web-platform-dx/baseline-browser-mapping[PACKAGE]
- https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142[WEB]
- https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0[WEB]
- https://www.npmjs.com/package/baseline-browser-mapping[WEB]