Skip to content
Fencer Vulns
high 7.5

CVE-2026-73088 json

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

published 2026-08-11 2 mo ago modified 2026-09-10 1 mo ago also GHSA-73wf-gq98-2v4g , EUVD-2026-56285

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Patch / fix

  • npm browserslist 4.28.7
  • node-browserslist Debian 14 4.28.7+~cs8.16.65-1

debian advisories DEBIAN-CVE-2026-73088

  • grafana12.4 hummingbird 1 12.4.8-0.1.1.hum1
  • grafana13.1 hummingbird 1 13.1.3-0.1.1.hum1

red hat advisories RHSA-2026:54518RHSA-2026:54517

  • agama-web-ui openSUSE Tumbleweed 24+0.a836cced5-52.1
  • python-pytest-html openSUSE Leap 16.0 4.1.1-bp160.5.1
  • bun openSUSE Tumbleweed 1.4.0~git20260808.52bf09cb-2.1
  • python-pytest-html openSUSE Tumbleweed 4.2.0-5.1

opensuse advisories openSUSE-SU-2026:11680-1openSUSE-SU-2026:21602-1openSUSE-SU-2026:11535-1openSUSE-SU-2026:11540-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-73088 updated cvss 7.5

browserslist: Browserslist: Prototype pollution leading to denial of service

  • Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 browserslist 4.21.5 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0 Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9 Red Hat Enterprise Linux 8 cockpit-composer
    +1 more products
    Red Hat Enterprise Linux 9 gjs 1.68.6-4.el9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.97.1-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7 jboss-eap-patch.zip, jboss-eap-maven-repository.zip, jboss-eap-full-maven-repository.zip, jboss-eap-runtime-maven-repository.zip, jboss-eap-incremental-maven-repository.zip
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 jboss-eap.1-runtime-maven-repository.zip 8.1.0 Red Hat OpenShift Container Platform 5 openshift5/nmstate-console-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 browserslist 4.21.5 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
show 21 more
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188
    fixed: vendor fix RHSA-2026:56357
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1786634825
    fixed: vendor fix RHSA-2026:54760
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel10 1789486181, rhem/flightctl-ui-ocp-rhel9 1789486446, rhem/flightctl-ui-ocp-rhel10 1789486226
    fixed: vendor fix RHSA-2026:68044
  • Red Hat Hardened Images grafana12.4 12.4.8-0.1.1.hum1, grafana13.1 13.1.3-0.1.1.hum1
    fixed: vendor fix RHSA-2026:54518
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-mod-arch-model-registry-rhel9 1788312157
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1791861020, rhoai/odh-mod-arch-maas-rhel9 1793001859, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, rhoai/odh-mod-arch-mlflow-rhel9 1793001851, +3 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift Container Platform 4.21 openshift4/nmstate-console-plugin-rhel9 1787590372
    fixed: vendor fix RHSA-2026:60478
  • Red Hat OpenShift Container Platform 4.22 openshift4/nmstate-console-plugin-rhel9 1787744843
    fixed: vendor fix RHSA-2026:60442
  • Red Hat Openshift Data Foundation 4.19 odf4/odf-console-rhel9 1793126829
    fixed: vendor fix RHSA-2026:92650
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1789144269, devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307

4 more fixed, 38 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm browserslist
<4.28.7
4.28.7

Affected products

  • browserslist browserslist

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
  • CWE-248 Uncaught Exception

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.