CVE-2026-73088

Received Received - Intake

Prototype Pollution in Browserslist Configuration Tool

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73088

EUVD

EUVD-2026-56285

Affected Vendors & Products

Vendor	Product	Version / Range
browserslist	browserslist	to 4.28.7 (exc)
browserslist	browserslist	4.28.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects the npm package browserslist versions 4.28.6 and below. It involves an uncaught crash and prototype pollution issue in the normalizeStats() function, which is called during every browserslist() operation. The function processes untrusted data from a browserslist-stats.json file or programmatically passed opts.stats, leading to crashes or prototype chain modifications.

Detection Guidance

Check if your system uses browserslist version 4.28.6 or below by running: npm list browserslist. If affected, look for a malicious browserslist-stats.json file in project directories. The vulnerability triggers crashes when browserslist() is called, so monitor for unexpected process terminations during builds or CI/CD pipelines.

Impact Analysis

An attacker can place a malicious browserslist-stats.json file in the project directory. When build or CI tools call browserslist(), the process crashes immediately due to an uncaught exception. This causes denial-of-service (DoS) with no authentication required, only the ability to add a file to the directory tree.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) by crashing applications using affected browserslist versions. It does not directly expose or leak data, so it may not directly violate GDPR or HIPAA. However, a DoS could disrupt services handling personal or health data, potentially leading to compliance issues if critical systems become unavailable.

Mitigation Strategies

Upgrade browserslist to version 4.28.7 or later using: npm update browserslist. Remove any untrusted browserslist-stats.json files from project directories. If using CI/CD, ensure builds fail safely and monitor for crashes during execution.

Hi! I’m here to help you understand CVE-2026-73088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70