CVE-2026-73088

Name of the Vulnerable Software and Affected Versions Browserslist versions prior to 4.28.7

Description The normalizeStats() function in node.js, which is called via getStat() and loadStat() during every browserslist() execution, improperly processes data from browserslist-stats.json, opts.stats, and the CLI --stats parameter. The use of an unguarded for...in loop combined with plain-object bracket access and assignment allows inherited Object.prototype keys—such as proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf—to trigger an uncaught TypeError or modify the prototype of the resulting normalized object.

Recommendations Update to version 4.28.7.