CVE-2026-73088

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73088
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-73088.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-73088
Aliases
Downstream
Related
Published
2026-08-11T17:00:05Z
Modified
2026-08-21T18:27:50Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321",
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73088.json"
}
References

Affected packages

Git / github.com/browserslist/browserslist

Affected ranges

Type
GIT
Repo
https://github.com/browserslist/browserslist
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f9914ad9effc865ccc27d816255625890b31ca51
Fixed
b637868045806d2fba4c24eb0060e4cc8b1db276
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.28.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.5.0
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.11.2
2.11.3
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.10.0
4.11.0
4.11.1
4.12.0
4.12.1
4.12.2
4.13.0
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4
4.14.5
4.14.6
4.14.7
4.15.0
4.16.0
4.16.1
4.16.2
4.16.3
4.16.4
4.16.5
4.16.6
4.16.7
4.16.8
4.17.0
4.17.1
4.17.2
4.17.3
4.17.4
4.17.5
4.17.6
4.18.0
4.18.1
4.19.0
4.19.1
4.19.2
4.19.3
4.2.0
4.2.1
4.20.0
4.20.1
4.20.2
4.20.3
4.20.4
4.21.0
4.21.1
4.21.10
4.21.11
4.21.2
4.21.3
4.21.4
4.21.5
4.21.6
4.21.7
4.21.8
4.21.9
4.22.0
4.22.1
4.22.2
4.22.3
4.23.0
4.23.1
4.23.2
4.23.3
4.24.0
4.24.1
4.24.2
4.24.3
4.24.5
4.25.0
4.25.1
4.25.2
4.25.3
4.25.4
4.26.0
4.26.1
4.26.2
4.26.3
4.27.0
4.28.0
4.28.1
4.28.2
4.28.3
4.28.4
4.28.5
4.28.6
4.3.0
4.3.1
4.3.2
4.3.3
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.5.3
4.5.5
4.5.6
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.9.0
4.9.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-73088.json"