autoprefixer-10.4.7.tgz: 2 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - autoprefixer-10.4.7.tgz

Sample Path to Dependency File: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/browserslist/package.json

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (autoprefixer version)	Remediation Possible**
CVE-2026-73089	High	7.5	browserslist-4.21.5.tgz	Transitive	N/A*	❌
CVE-2026-73088	High	7.5	browserslist-4.21.5.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-73089

Vulnerable Library - browserslist-4.21.5.tgz

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz

Sample Path to Dependency File: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/browserslist/package.json

Dependency Hierarchy:

• autoprefixer-10.4.7.tgz (Root Library)
  • ❌ browserslist-4.21.5.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct "(queries, context)" result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since "--" queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Publish Date: 2026-08-11

URL: CVE-2026-73089

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c83g-rgw3-j3cx

Release Date: 2026-08-11

Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7

Step up your Open Source Security Game with Mend here

CVE-2026-73088

Vulnerable Library - browserslist-4.21.5.tgz

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz

Sample Path to Dependency File: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/browserslist/package.json

Dependency Hierarchy:

• autoprefixer-10.4.7.tgz (Root Library)
  • ❌ browserslist-4.21.5.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-08-11

URL: CVE-2026-73088

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-73wf-gq98-2v4g

Release Date: 2026-08-11

Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7

Step up your Open Source Security Game with Mend here