CVE-2026-45819: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2026-45819 is a Denial of Service vulnerability in the baseline-browser-mapping npm package (by web-platform-dx) affecting all 2.x versions before 2.11.0. The flaw causes the library to call process.exit() instead of throwing an exception when it receives invalid or conflicting input parameters, resulting in immediate Node.js process termination. It was published on August 13, 2026, with a CVSS v4 base score of 6.6 (Medium) (Github Advisory, Feedly).

The root cause is improper error handling (CWE-755: Improper Handling of Exceptional Conditions) combined with incorrect control flow scoping (CWE-705) and a reachable assertion pattern (CWE-617). Specifically, in src/index.ts at line 142, the kaiOSWarning() function and the getCompatibleVersions() function call process.exit(1) when mutually exclusive options (e.g., targetYear and widelyAvailableOnDate used simultaneously, or includeKaiOS: true with includeDownstreamBrowsers: false) are detected, rather than throwing a catchable JavaScript Error (Github Source). This means any calling application cannot intercept or recover from the error via standard try/catch mechanisms, and the entire Node.js process is unconditionally terminated (Github Advisory). The fix, introduced in PR #137, replaces process.exit() calls with proper throw new Error(...) statements (PR #137).

Successful exploitation causes immediate and unrecoverable termination of the Node.js process hosting the vulnerable library, resulting in a complete availability loss for the affected application. Any user or automated process capable of supplying conflicting or invalid input parameters to the getCompatibleVersions() or getAllVersions() functions can trigger this crash. There is no impact on confidentiality or integrity, and no lateral movement potential; the impact is limited to availability of the affected service (Github Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is automatable (NVD SSVC: automatable = yes), meaning an attacker can craft requests at scale without manual interaction, but exploitation requires the ability to influence the input parameters passed to the library. The EPSS score is approximately 0.37% (30th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify target: Locate a web application or service that uses baseline-browser-mapping version 2.0.0–2.10.x as a dependency and exposes an interface (e.g., API endpoint, CLI tool, or form) that passes user-controlled data as options to getCompatibleVersions() or getAllVersions().
2. Craft conflicting parameters: Prepare an input that simultaneously specifies both targetYear and widelyAvailableOnDate options, or sets includeKaiOS: true alongside includeDownstreamBrowsers: false.
3. Submit the payload: Send the crafted input to the target application through whatever interface accepts these parameters (e.g., an HTTP request body, query string, or CLI argument).
4. Trigger process termination: The library's internal validation detects the conflicting options and calls process.exit(1), immediately terminating the Node.js process without giving the application a chance to catch the error, resulting in a service crash and denial of service (Github Source, Github Advisory).

• Logs: Abrupt Node.js process exit with exit code 1 in application logs or process manager logs (e.g., PM2, systemd) without a preceding uncaught exception stack trace; log entries showing the application restarting unexpectedly.
• Application Behavior: Repeated, sudden crashes of Node.js services that use baseline-browser-mapping, particularly correlated with incoming requests containing browser compatibility query parameters.
• Process: Node.js process terminating with process.exit(1) rather than a thrown error; absence of a JavaScript stack trace in crash logs (distinguishing this from a normal unhandled exception).

Upgrade baseline-browser-mapping to version 2.11.0 or later, which replaces all process.exit() calls with proper throw new Error() statements, allowing calling applications to handle errors gracefully (Github Advisory, PR #137). As a short-term workaround where upgrading is not immediately possible, implement strict server-side input validation to reject conflicting parameter combinations (e.g., simultaneous targetYear + widelyAvailableOnDate, or includeKaiOS: true + includeDownstreamBrowsers: false) before they are passed to the library. Additionally, restrict which users or processes can supply raw options to the library (Feedly).

Red Hat opened a high-severity Bugzilla ticket (Bug 2515240) tracking this CVE across their product portfolio, with 86 users CC'd, indicating broad internal concern about the dependency's presence in Red Hat ecosystem packages (Red Hat Bugzilla). The GitHub Advisory Database published the advisory on August 13, 2026, though it remains unreviewed and no package ecosystem mapping has been confirmed (Github Advisory). No significant public researcher commentary or media coverage has been identified beyond standard vulnerability database entries.