CVE-2026-73088: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browserslistto a version that resolves this vulnerability.Fixed in 4.28.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73088?
CVE-2026-73088 has a severity rating of 7.5, which is classified as high.
How do I fix CVE-2026-73088?
To fix CVE-2026-73088, upgrade to Browserslist version 4.28.7 or later.
What does CVE-2026-73088 affect?
CVE-2026-73088 affects the Browserslist tool used for sharing target browser configurations.
What type of vulnerability is CVE-2026-73088?
CVE-2026-73088 is a vulnerability that can cause an uncaught crash and allows for a prototype write.
When was CVE-2026-73088 published?
CVE-2026-73088 was published on August 11, 2026.