CVE-2026-73088
Description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
browserslistnpm | < 4.28.7 | 4.28.7 |
Affected products
28- osv-coords26 versionspkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/nextcloud-server-34pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/wazuh-dashboard-dashboards-reportingpkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fipspkg:rpm/opensuse/bun&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/agama-web-ui&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-pytest-html&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-24pkg:apk/wolfi/nextcloud-server-32pkg:apk/chainguard/langfuse-4-workerpkg:apk/chainguard/ts-patchpkg:apk/chainguard/nextcloud-server-32pkg:apk/wolfi/vitess-24pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/vitess-23pkg:npm/browserslistpkg:apk/wolfi/vitess-23pkg:apk/wolfi/ts-patchpkg:rpm/opensuse/python-pytest-html&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/langfuse-fips-4-worker
< 2025.12.6-r13+ 25 more
- (no CPE)range: < 2025.12.6-r13
- (no CPE)range: < 19.3.1-r6
- (no CPE)range: < 34.0.3-r4
- (no CPE)range: < 2026.5.6-r15
- (no CPE)range: < 4.14.7-r13
- (no CPE)range: < 4.14.7-r14
- (no CPE)range: < 1.4.0~git20260808.52bf09cb-2.1
- (no CPE)range: < 24+0.a836cced5-52.1
- (no CPE)range: < 4.2.0-5.1
- (no CPE)range: < 3.12.9.4-r28
- (no CPE)range: < 22.0.4-r22
- (no CPE)range: < 24.0.3-r1
- (no CPE)range: < 32.0.14-r2
- (no CPE)range: < 4.27.0-r2
- (no CPE)range: < 4.0.1-r44
- (no CPE)range: < 32.0.14-r2
- (no CPE)range: < 24.0.3-r1
- (no CPE)range: < 3.225.5-r1
- (no CPE)range: < 2026.5.6-r16
- (no CPE)range: < 23.0.6-r3
- (no CPE)range: < 4.28.7
- (no CPE)range: < 23.0.6-r3
- (no CPE)range: < 4.0.1-r44
- (no CPE)range: < 4.1.1-bp160.5.1
- (no CPE)range: < 3.11.14.5-r15
- (no CPE)range: < 4.26.0-r2
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.28.7
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-73wf-gq98-2v4gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-73088ghsaADVISORY
- github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51nvdWEB
- github.com/browserslist/browserslist/releases/tag/4.28.7nvdWEB
- github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4gnvdWEB
News mentions
0No linked articles in our index yet.