CVE-2026-73088: Browserslist Uncaught Crash and Prototype Write via Untrusted browserslist-stats.json Custom Stats
Summary
CVE-2026-73088: Vulnerability Details File: node.js Function: normalizeStats() (line ~214), reached from getStat() (called unconditionally on every browserslist() call) and loadStat() Root Cause js function normalizeStats(data, stats) {... Affects browserslist versions < 4.28.7. Fixed in 4.28.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Browserslist is a popular tool used in web development to specify which browsers should be supported by front-end tools like Autoprefixer, Babel, and Stylelint. It allows developers to define a set of browsers based on various criteria, ensuring compatibility and optimal performance across different environments. However, a vulnerability has been identified that can lead to crashes and potential prototype pollution when untrusted data is processed.
Vulnerability Detail
The vulnerability arises from the function normalizeStats() in Browserslist, which processes a stats object derived from a browserslist-stats.json file. This file is auto-discovered in the project directory tree and can be manipulated by an attacker. The lack of proper validation allows an attacker to introduce keys that are part of the Object.prototype, leading to an uncaught TypeError when the code attempts to access properties on these keys. This can cause the application to crash on any Browserslist call, impacting the build process and potentially leading to denial of service. The vulnerability is exacerbated by the fact that it runs on every Browserslist call, making it easy for an attacker to exploit.
How To Fix
Latest published version: 4.29.4 as of 23 Oct 2026
npm install browserslist@4.29.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.28.7
This is the first release that contains the fix.
npm install browserslist@4.28.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the browserslist-stats.json file or ensure that it does not contain any keys that are part of the Object.prototype. Additionally, you can manually validate the contents of the stats object before passing it to Browserslist functions.
Conclusion
The Browserslist vulnerability CVE-2026-73088 poses a significant risk by allowing untrusted data to cause application crashes and potential prototype pollution. It is crucial for developers to update to the patched version 4.28.7 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for browserslist →
FAQ
The vulnerability can cause an uncaught TypeError, leading to application crashes on any Browserslist call, which can disrupt the build process.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json, it can help identify if your application is affected by this vulnerability.
If an immediate update is not possible, consider removing or validating the browserslist-stats.json file to prevent potential exploitation.
Yes, you can use tools like npm-check-updates to automate the process of updating your dependencies, including Browserslist.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for browserslist.
