AIKIDO-2026-626653
baseline-browser-mapping is vulnerable to Denial of Service (DoS)
66
Medium Risk
This Affects:
baseline-browser-mappingTL;DR
The getCompatibleVersions() and getAllVersions() functions in baseline-browser-mapping call process.exit() when they receive invalid or conflicting configuration options, such as supplying both targetYear and widelyAvailableOnDate, or setting includeKaiOS: true with includeDownstreamBrowsers: false. An application that forwards user-controlled values into these options can be forced to terminate its entire host process. The fix removes the process.exit() calls and throws a catchable Error instead.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes user-controlled values into the getCompatibleVersions() or getAllVersions() configuration options without validating them first.
Background info
baseline-browser-mapping is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.10.44.
How to fix this
Upgrade the baseline-browser-mapping library to the patch version.
Links
Other
github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
npmjs.com/package/baseline-browser-mapping
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant