Improper handling of exceptional conditions in web-platform-dx baseline-browser-mapping
Priority LOW 36CWE-705Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 12 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Partial baseline-browser-mapping (web-platform-dx): 2.11.0baseline-browser-mapping (npm): 2.11.0Red Hat: 16 advisoriesRed Hat: 11 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| web-platform-dx | baseline-browser-mapping | 2.0.0 to before 2.11.0 | 2.11.0 | Patch available | CNA |
| — | baseline-browser-mapping (npm) | 2.0.0 to before 2.11.0 | 2.11.0 | Patch available | GHSA-w5vr-8v7q-w6rv |
- baseline-browser-mapping Vendorweb-platform-dx Affected 2.0.0 to before 2.11.0 Fixed in 2.11.0 Patch available CNA
- baseline-browser-mapping (npm) Vendor— Affected 2.0.0 to before 2.11.0 Fixed in 2.11.0 Patch available GHSA-w5vr-8v7q-w6rv
Remediation
- Fix · CNA baseline-browser-mapping (web-platform-dx) Fixed in 2.11.0
- Fix · GHSA-w5vr-8v7q-w6rv baseline-browser-mapping (npm) Fixed in 2.11.0 Advisory →
Red Hat 16 advisories
- RHSA-2026:92650 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 13 more Red Hat advisories
- RHSA-2026:71454 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.22.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-node-termination-handler-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator +8
- RHSA-2026:68553 Released 2026-09-22 · Red Hat rating ImportantOpenShift Container Platform 4.22.15 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator
- RHSA-2026:68547 Released 2026-09-22 · Red Hat rating ImportantOpenShift Container Platform 4.21.34 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9 +1
- RHSA-2026:68765 Released 2026-09-17 · Red Hat rating ImportantTechnical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
- RHSA-2026:68755 Released 2026-09-17 · Red Hat rating ImportantTechnical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
- RHSA-2026:68754 Released 2026-09-17 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.1 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
- RHSA-2026:68254 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.1 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:68253 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.4 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
- RHSA-2026:68044 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.4 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:68006 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.1 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:54518 Released 2026-08-13 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.8-0.1.1.hum1@aarch64, grafana12.4-12.4.8-0.1.1.hum1@src, grafana12.4-12.4.8-0.1.1.hum1@x86_64
- RHSA-2026:54517 Released 2026-08-13 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.3-0.1.1.hum1@aarch64, grafana13.1-13.1.3-0.1.1.hum1@src, grafana13.1-13.1.3-0.1.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:68044, RHSA-2026:68253 |
| Red Hat Edge Manager 1.2 | Fixed | RHSA-2026:68006, RHSA-2026:68254 |
| Red Hat Hardened Images | Fixed | RHSA-2026:54517, RHSA-2026:54518 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734, RHSA-2026:92510 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:68547 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:68553, RHSA-2026:71454 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:68754 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:92650 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:68765 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:68755 |
Not affected: 25 products
- Cryostat 4
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Edge Manager 1.1
- Red Hat Edge Manager 1.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat Openshift Data Foundation 4.19
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45819
- 2026-10-03 Alias added: GHSA-w5vr-8v7q-w6rv
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
- 2026-10-31 Affected versions changed · Red Hat
References
Other 6
- https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
- https://www.npmjs.com/package/baseline-browser-mapping
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137
- https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589
- https://github.com/web-platform-dx/baseline-browser-mapping
- https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0
Sources
- CVE-2026-45819 · CVE Program
- CVE-2026-45819 · NVD
- FIRST EPSS
- GHSA-w5vr-8v7q-w6rv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45819 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences