CVE-2026-73088: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Vulnerability summary
CVE-2026-73088 is a high (CVSS 7.5) Uncaught Exception vulnerability in browserslist. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 11-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.66% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
- CWE-1321Improperly Controlled Modification of Object Prototype AttributesThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard49 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- arangodb-3.11< 3.11.14.5-r15
- arangodb-3.12< 3.12.9.4-r28
- argo-workflows-ui-4.0< 4.0.11-r0
Wolfi9 products
- argo-workflows-ui-4.0< 4.0.11-r0
- jupyter-base-notebook< 7.6.3-r2
- katib-suggestion-hyperopt< 0.19.0-r40
- langfuse-3-compat< 3.225.7-r6
- langfuse-3-worker< 3.225.7-r4
Opensuse2 products
- bun&distro=openSUSE Tumbleweed< 1.4.0~git20260808.52bf09cb-2.1
- python-pytest-html&distro=openSUSE Tumbleweed< 4.2.0-5.1
Browserslist1 product
- browserslist< 4.28.7
Debian1 product
- node-browserslistAll versions (No fix recorded) | < 4.28.7+~cs8.16.65-1
Npm1 product
- browserslist< 4.28.7
Ubuntu1 product
- node-browserslistAll versions (No fix recorded)
7 vendors · 64 products
References
10 links- github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4gX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51X Refsource MISCREPORTFIXWEB
