Executive brief
Browserslist is a library used by web build tools (Babel, PostCSS, Stylelint, Autoprefixer) to determine which browser versions a project should target. An attacker can place a malicious browserslist-stats.json file in a project's directory tree, or supply crafted stats data, causing the library to crash with an uncaught error on any browserslist() call. Since stats files are auto-discovered and processed on every call regardless of query, a single poisoned file breaks all downstream build and CI pipelines that invoke the library, even indirectly through other tools.
Technical details
The vulnerability exists in the normalizeStats() function in node.js (line ~214), which processes untrusted stats data loaded from browserslist-stats.json files (auto-discovered by directory traversal on every browserslist() call) or from opts.stats passed programmatically/via CLI. The function iterates over stats keys using an unguarded for...in loop and performs bracket access/assignment without hasOwnProperty checks. Two independent bugs result: (1) Crash—when a stats key matches an inherited Object.prototype member name like "__proto__", "toString", or "valueOf", the check data[i] resolves to the inherited function instead of undefined, then accessing data[i].versions.length on a non-object (function) throws an uncaught TypeError; (2) Prototype pollution—assignment to normalized[i] when i === "__proto__" invokes the __proto__ setter, mutating the object's [[Prototype]]. The fix uses Object.create(null) for normalized objects and adds an explicit hasOwnProperty guard for data lookups. Patched in version 4.28.7.
Affected products
- browserslist browserslist <= 4.28.6
Timeline
- 2026-09-01: disclosed: GHSA advisory published
- 2026-09-01: patched: Fix released in browserslist 4.28.7
- 2026-08-11: kev added: CVE-2026-73088 published in NVD
References
- https://api.github.com/users/iaohkut-from-NightWolf-Team
- https://github.com/iaohkut-from-NightWolf-Team
- https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D
- https://api.github.com/users/iaohkut-from-NightWolf-Team/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D