DEBIAN-CVE-2026-73088

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-73088
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73088.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-73088
Upstream
Published
2026-08-11T17:19:16Z
Modified
2026-09-10T08:47:20Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

References

Affected packages

Debian:12 / node-browserslist

Package

Name
node-browserslist
Purl
pkg:deb/debian/node-browserslist?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.21.4+~cs6.1.17-2
4.21.10+~cs6.1.25-1
4.21.10+~cs6.1.25-2
4.22.1+~cs6.1.27-1
4.22.1+~cs6.1.28-1
4.23.0+~cs6.1.32-1
4.24.4+~cs6.3.21-1
4.24.4+~cs6.3.22-1
4.25.0+~cs6.3.22-1
4.25.2+~cs6.3.22-1
4.26.0+~cs8.11.27-1
4.27.0+~cs8.11.53-1
4.27.0+~cs8.11.53-2
4.28.1+~cs8.14.48-1
4.28.2+~cs8.14.68-1
4.28.7+~cs8.16.65-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73088.json"

Debian:13 / node-browserslist

Package

Name
node-browserslist
Purl
pkg:deb/debian/node-browserslist?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.25.0+~cs6.3.22-1
4.25.2+~cs6.3.22-1
4.26.0+~cs8.11.27-1
4.27.0+~cs8.11.53-1
4.27.0+~cs8.11.53-2
4.28.1+~cs8.14.48-1
4.28.2+~cs8.14.68-1
4.28.7+~cs8.16.65-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73088.json"

Debian:14 / node-browserslist

Package

Name
node-browserslist
Purl
pkg:deb/debian/node-browserslist?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.28.7+~cs8.16.65-1

Affected versions

4.*
4.25.0+~cs6.3.22-1
4.25.2+~cs6.3.22-1
4.26.0+~cs8.11.27-1
4.27.0+~cs8.11.53-1
4.27.0+~cs8.11.53-2
4.28.1+~cs8.14.48-1
4.28.2+~cs8.14.68-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73088.json"