Advisories for Npm/Browserslist package

Who is affected: Any project whose build/CI invokes Browserslist (directly or via Autoprefixer/Babel/Stylelint/PostCSS) in a directory tree an attacker can place a file into (external PR, compromised dependency), or any app that passes user-influenced data into opts.stats. What an attacker achieves: Immediate DoS — crashes the invoking process on the first Browserslist call after the file is present, for any query, no special syntax needed. Conditions required: No authentication — …

Who is affected: Long-running processes calling browserslist() with query values that vary across requests/items and are influenced by external input. What an attacker achieves: DoS via eventual out-of-memory crash, given sustained traffic over time (not a single small payload). Conditions required: No authentication; requires volume rather than a single request, hence Medium rather than High severity.

The package browserslist from is vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.