CVE-2026-73088

HIGH 7.5

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

CWE	CWE-1321 CWE-248
Vendor	browserslist
Product	browserslist
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for browserslist browserslist

Be the first to know when new high vulnerabilities affecting browserslist browserslist are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

browserslist / browserslist

< 4.28.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g github.com: https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51 github.com: https://github.com/browserslist/browserslist/releases/tag/4.28.7