CVE-2026-73088

Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.44%• Percentile: 38%

Techniques & Countermeasures

• CWE-248•Uncaught Exception

  An exception is thrown from a function, but it is not caught.

• CWE-1321•Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Systems

• chainguard•airflow-2

  all

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.11

  < 3.11.14.5-r15

• chainguard•arangodb-3.12

  < 3.12.9.4-r28

• chainguard•argo-workflows-ui-4.0

  < 4.0.11-r0

• chainguard•authentik-2025.12

  < 2025.12.6-r13

• chainguard•authentik-2026.5

  < 2026.5.6-r16

• chainguard•authentik-fips-2025.12

  all

• chainguard•authentik-fips-2026.5

  < 2026.5.6-r15

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.7-r7

• chainguard•jupyter-base-notebook

  all

• chainguard•katib-suggestion-hyperopt

  < 0.19.0-r40

• chainguard•langfuse-3-compat

  < 3.225.7-r6

• chainguard•langfuse-3-worker

  all | < 3.225.7-r4

• chainguard•langfuse-4-worker

  < 4.27.0-r2

• chainguard•langfuse-fips-3-worker

  < 3.225.5-r1

• chainguard•langfuse-fips-4-worker

  < 4.26.0-r2

• chainguard•nextcloud-server-32

  < 32.0.14-r2

• chainguard•nextcloud-server-34

  < 34.0.3-r4

• chainguard•tensorflow-gpu-jupyter

  all | < 2.21.0-r9

• chainguard•ts-patch

  < 4.0.1-r44

• chainguard•vitess-22

  < 22.0.4-r22

• chainguard•vitess-23

  < 23.0.6-r3

• chainguard•vitess-24

  < 24.0.3-r1

• chainguard•vitess-24-compat

  < 24.0.3-r7

• chainguard•wazuh-dashboard-dashboards-reporting

  < 4.14.7-r13

• chainguard•wazuh-dashboard-dashboards-reporting-fips

  < 4.14.7-r14

• wolfi•argo-workflows-ui-4.0

  < 4.0.11-r0

• wolfi•jupyter-base-notebook

  all

• wolfi•katib-suggestion-hyperopt

  < 0.19.0-r40

• wolfi•langfuse-3-compat

  < 3.225.7-r6

Showing first 50 affected entries in server-rendered view.

References (10)

• https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g
• https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51
• https://github.com/browserslist/browserslist/releases/tag/4.28.7
• https://security-tracker.debian.org/tracker/CVE-2026-73088
• https://ubuntu.com/security/CVE-2026-73088
• https://www.cve.org/CVERecord?id=CVE-2026-73088
• https://www.suse.com/security/cve/CVE-2026-73088
• https://nvd.nist.gov/vuln/detail/CVE-2026-73088
• https://github.com/browserslist/browserslist
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73088.json