{"id":"CVE-2026-73088","aliases":["CLSA-2026-1790004614","CLSA-2026-1790016470","CLSA-2026-1790175577","CLSA-2026-1790177674","CLSA-2026-1790541831","CLSA-2026-1790544273","CLSA-2026-1790604921","CLSA-2026-1790615783","CLSA-2026-1791199466","CLSA-2026-1792163369","CLSA-2026-1792443101","CLSA-2026-1792473159","CLSA-2026-1792477554","CLSA-2026-1792495777","CLSA-2026-1793180856","CLSA-2026-1793445784","CLSA-2026-1793445883","CLSA-2026-1793445987","CLSA-2026-1793446139","CLSA-2026-1794048476","CLSA-2026-1794048573","DEBIAN-CVE-2026-73088","EUVD-2026-56285","GHSA-73wf-gq98-2v4g","RHSA-2026:54517","RHSA-2026:54518","ROOT-APP-NPM-CVE-2026-73088","UBUNTU-CVE-2026-73088","openSUSE-SU-2026:11535-1","openSUSE-SU-2026:11540-1","openSUSE-SU-2026:11680-1","openSUSE-SU-2026:21602-1"],"status":"published","title":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00658,"percentile":0.5183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-248"],"published":"2026-08-11T17:00:05Z","modified":"2026-11-07T13:15:02Z","fixes":[{"ecosystem":"npm","package":"browserslist","fixed_in":["4.28.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"browserslist","fixed_in":["4.14.2-tuxcare.2","4.10.0-tuxcare.4","3.2.8-tuxcare.1","2.11.3-tuxcare.1","1.7.7-tuxcare.1","4.24.4-tuxcare.1","4.24.0-tuxcare.1","4.28.1-tuxcare.1","4.23.0-tuxcare.2","4.23.1-tuxcare.2","4.21.10-tuxcare.2","4.23.2-tuxcare.2","4.24.5-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-browserslist","fixed_in":["4.28.7+~cs8.16.65-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"browserslist","fixed_in":["4.20.3-aikido.1","4.28.4-aikido.1","4.28.1-aikido.1","4.12.0-aikido.1","4.14.2-aikido.2","4.20.2-aikido.1","4.22.2-aikido.1","4.25.1-aikido.1","4.28.2-aikido.1","4.23.0-aikido.1","4.21.2-aikido.1","4.21.5-aikido.1","3.2.8-aikido.1","4.24.2-aikido.1","4.24.0-aikido.1","1.7.7-aikido.1","4.7.0-aikido.1","4.17.1-aikido.1","4.21.4-aikido.1","1.7.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/browserslist","fixed_in":["4.20.3-root.io.1","4.28.4-root.io.1","4.28.1-root.io.1","4.12.0-root.io.1","4.14.2-root.io.2","4.20.2-root.io.1","4.22.2-root.io.1","4.25.1-root.io.1","4.28.2-root.io.1","4.23.0-root.io.1","4.21.2-root.io.1","4.21.5-root.io.1","3.2.8-root.io.1","4.24.2-root.io.1","4.24.0-root.io.1","1.7.7-root.io.1","4.7.0-root.io.1","4.17.1-root.io.1","4.21.4-root.io.1","1.7.7-root.io.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bun","fixed_in":["1.4.0~git20260808.52bf09cb-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pytest-html","fixed_in":["4.2.0-5.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.28.6"},{"fixed":"4.28.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.2-tuxcare.0"},{"fixed":"4.14.2-tuxcare.2"}]}],"versions":["4.14.2","4.14.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.10.0-tuxcare.0"},{"fixed":"4.10.0-tuxcare.4"}]}],"versions":["4.10.0","4.10.0-tuxcare.1","4.10.0-tuxcare.2","4.10.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.27.0-tuxcare.0"},{"fixed":"4.27.0-tuxcare.2"}]}],"versions":["4.27.0","4.27.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0-tuxcare.0"},{"fixed":"4.13.0-tuxcare.3"}]}],"versions":["4.13.0","4.13.0-tuxcare.1","4.13.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8-tuxcare.0"},{"fixed":"3.2.8-tuxcare.1"}]}],"versions":["3.2.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3-tuxcare.0"},{"fixed":"2.11.3-tuxcare.1"}]}],"versions":["2.11.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.4-tuxcare.0"},{"fixed":"4.24.4-tuxcare.1"}]}],"versions":["4.24.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.5-tuxcare.0"},{"fixed":"4.21.5-tuxcare.1"}]}],"versions":["4.21.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.0-tuxcare.0"},{"fixed":"4.24.0-tuxcare.1"}]}],"versions":["4.24.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.5-tuxcare.0"},{"fixed":"4.28.5-tuxcare.1"}]}],"versions":["4.28.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.1"}]}],"versions":["4.28.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.4-tuxcare.0"},{"fixed":"4.28.4-tuxcare.1"}]}],"versions":["4.28.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.2-tuxcare.0"},{"fixed":"4.28.2-tuxcare.1"}]}],"versions":["4.28.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.3-tuxcare.0"},{"fixed":"4.23.3-tuxcare.1"}]}],"versions":["4.23.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.0-tuxcare.0"},{"fixed":"4.23.0-tuxcare.2"}]}],"versions":["4.23.0","4.23.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.1-tuxcare.0"},{"fixed":"4.23.1-tuxcare.2"}]}],"versions":["4.23.1","4.23.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.10-tuxcare.0"},{"fixed":"4.21.10-tuxcare.2"}]}],"versions":["4.21.10","4.21.10-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.2-tuxcare.0"},{"fixed":"4.23.2-tuxcare.2"}]}],"versions":["4.23.2","4.23.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.5-tuxcare.0"},{"fixed":"4.24.5-tuxcare.1"}]}],"versions":["4.24.5"]},{"source":"osv","ecosystem":"Debian:12","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.10+~cs6.1.25-1","4.21.10+~cs6.1.25-2","4.21.4+~cs6.1.17-2","4.22.1+~cs6.1.27-1","4.22.1+~cs6.1.28-1","4.23.0+~cs6.1.32-1","4.24.4+~cs6.3.21-1","4.24.4+~cs6.3.22-1","4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1","4.28.7+~cs8.16.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1","4.28.7+~cs8.16.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.28.7+~cs8.16.65-1"}]}],"versions":["4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1"]},{"source":"osv","ecosystem":"npm","package":"browserslist","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.28.7"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.1.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.8-0.1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-aikido.1"},{"fixed":"4.28.4-aikido.1"},{"fixed":"4.28.1-aikido.1"},{"fixed":"4.12.0-aikido.1"},{"fixed":"4.14.2-aikido.2"},{"fixed":"4.20.2-aikido.1"},{"fixed":"4.22.2-aikido.1"},{"fixed":"4.25.1-aikido.1"},{"fixed":"4.28.2-aikido.1"},{"fixed":"4.23.0-aikido.1"},{"fixed":"4.21.2-aikido.1"},{"fixed":"4.21.5-aikido.1"},{"fixed":"3.2.8-aikido.1"},{"fixed":"4.24.2-aikido.1"},{"fixed":"4.24.0-aikido.1"},{"fixed":"1.7.7-aikido.1"},{"fixed":"4.7.0-aikido.1"},{"fixed":"4.17.1-aikido.1"},{"fixed":"4.21.4-aikido.1"},{"fixed":"1.7.7-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-root.io.1"},{"fixed":"4.28.4-root.io.1"},{"fixed":"4.28.1-root.io.1"},{"fixed":"4.12.0-root.io.1"},{"fixed":"4.14.2-root.io.2"},{"fixed":"4.20.2-root.io.1"},{"fixed":"4.22.2-root.io.1"},{"fixed":"4.25.1-root.io.1"},{"fixed":"4.28.2-root.io.1"},{"fixed":"4.23.0-root.io.1"},{"fixed":"4.21.2-root.io.1"},{"fixed":"4.21.5-root.io.1"},{"fixed":"3.2.8-root.io.1"},{"fixed":"4.24.2-root.io.1"},{"fixed":"4.24.0-root.io.1"},{"fixed":"1.7.7-root.io.1"},{"fixed":"4.7.0-root.io.1"},{"fixed":"4.17.1-root.io.1"},{"fixed":"4.21.4-root.io.1"},{"fixed":"1.7.7-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.3-1","2.11.3-1build3","2.11.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.3+~cs5.4.72-3","4.17.0+~cs5.6.76-1","4.18.1+~cs5.1.2-1","4.19.1+~cs5.1.2-1","4.19.1+repack+~cs5.1.2-2","4.19.3+~cs5.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.4+~cs6.1.17-2","4.22.1+~cs6.1.28-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0~git20260808.52bf09cb-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pytest-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pytest-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-bp160.5.1"}]}],"bundled":2}],"products":[{"vendor":"browserslist","product":"browserslist"}],"references":[{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-73wf-gq98-2v4g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73088.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73089","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16221","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","tags":["article"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","tags":["article"]},{"url":"https://www.npmjs.com/package/baseline-browser-mapping","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65904","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65911","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65912","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65913","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65914","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73088","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54518","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54518.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-73088","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://bugzilla.suse.com/1275374","tags":["report"]},{"url":"https://bugzilla.suse.com/1275437","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-73088","title":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:00:05.869Z","modified":"2026-08-13T14:50:43.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1321","CWE-248"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-56285","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:00:05Z","modified":"2026-08-13T14:50:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:56.415282Z"}],"ghsa":[{"id":"GHSA-73wf-gq98-2v4g","title":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","description":"## Vulnerability Details\n\n**File**: `node.js`\n**Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called\n**unconditionally** on every `browserslist()` call) and `loadStat()`\n\n### Root Cause\n```js\nfunction normalizeStats(data, stats) {\n  if (!data) { data = {} }\n  if (stats \u0026\u0026 'dataByBrowser' in stats) { stats = stats.dataByBrowser }\n  if (typeof stats !== 'object') return undefined\n\n  var normalized = {}\n  for (var i in stats) {\n    var versions = Object.keys(stats[i])\n    if (versions.length === 1 \u0026\u0026 data[i] \u0026\u0026 data[i].versions.length === 1) {\n      var normal = data[i].versions[0]\n      normalized[i] = {}\n      normalized[i][normal] = stats[i][versions[0]]\n    } else {\n      normalized[i] = stats[i]\n    }\n  }\n  return normalized\n}\n```\n`stats` is untrusted: it comes from `JSON.parse()`-ing a\n`browserslist-stats.json` file — auto-discovered by walking up the directory\ntree from the project root **on every `browserslist()` call, regardless of\nthe query** (`env.getStat(opts, browserslist.data)` runs unconditionally\ninside `browserslist()`) — or from `opts.stats` passed programmatically /\nvia the CLI's `--stats=` flag. `data` is `browserslist.data`, a plain object\npopulated only with real browser names.\n\nTwo independent bugs from the same root cause (unguarded `for...in` over\nuntrusted keys used with plain-object bracket access/assignment):\n\n1. **Crash**: `data[i]` has no `hasOwnProperty` guard. If `stats` contains a\n   key that also happens to be an inherited `Object.prototype` member name —\n   `\"__proto__\"`, `\"toString\"`, `\"valueOf\"`, `\"constructor\"`,\n   `\"hasOwnProperty\"`, `\"isPrototypeOf\"`, etc. — `data[i]` resolves to that\n   inherited function/object (always truthy), and the code then does\n   `data[i].versions.length` → `undefined.length` → **uncaught `TypeError`**,\n   for any such key whose JSON value has exactly one sub-key, e.g.:\n   ```json\n   { \"toString\": { \"onekey\": 5 }, \"chrome\": { \"100\": 50 } }\n   ```\n2. **Prototype write**: `normalized[i] = ...` on the fresh\n   `normalized = {}` — if `i` is exactly `\"__proto__\"` (and `normalized` has\n   no own property by that name yet), this computed assignment invokes the\n   real `Object.prototype.__proto__` setter, changing `normalized`'s actual\n   `[[Prototype]]` instead of creating a plain property.\n\nBecause this runs on **every** `browserslist()` call regardless of the\nquery, simply committing a poisoned `browserslist-stats.json` anywhere in a\nproject's directory tree breaks every subsequent Browserslist call in that\nproject — including calls made by Autoprefixer, Babel `preset-env`,\nStylelint, or PostCSS internally, for completely unrelated queries.\n\n### Attack Scenario\n1. Attacker submits a PR (or a compromised dependency) adding a\n   `browserslist-stats.json` file anywhere between the project root and\n   filesystem root, containing e.g.\n   `{\"toString\": {\"onekey\": 5}, \"chrome\": {\"100\": 50}}`.\n2. The victim's build/CI pipeline runs any tool that calls `browserslist()`\n   internally, for **any** query.\n3. The auto-discovered poisoned file crashes the process with an uncaught\n   `TypeError` on the very first call.\n\n### Measured Impact\nConfirmed crash (real `browserslist()` call, v4.28.6) with `stats` keys:\n`__proto__`, `toString`, `valueOf`, `hasOwnProperty`, `constructor`,\n`isPrototypeOf` — each paired with a one-key JSON object — for any query,\nincluding `browserslist('defaults')` which never mentions stats.\n\n### Recommended Fix (implemented and verified)\n```js\nvar normalized = Object.create(null)\nfor (var i in stats) {\n  var versions = Object.keys(stats[i])\n  var known = Object.prototype.hasOwnProperty.call(data, i) \u0026\u0026 data[i]\n  if (versions.length === 1 \u0026\u0026 known \u0026\u0026 known.versions.length === 1) {\n    var normal = known.versions[0]\n    normalized[i] = Object.create(null)\n    normalized[i][normal] = stats[i][versions[0]]\n  } else {\n    normalized[i] = stats[i]\n  }\n}\nreturn normalized\n```\n`normalized` uses `Object.create(null)` so a write to `\"__proto__\"` is an\nordinary property set, never a `[[Prototype]]` change; `data[i]` is replaced\nwith an explicit `hasOwnProperty` check so it never resolves to an inherited\n`Object.prototype` member.\n\n**Verification**:\n- `NODE_ENV=test npx uvu test .test.js` → 301/301 pass unmodified\n  (`test/custom.test.js`, `test/shareable-stats.test.js`, `test/cover.test.js`\n  exercise the stats-handling paths).\n- All 6 previously crash-inducing keys, tested individually, now resolve\n  without error.\n- The realistic file-based auto-discovery scenario (poisoned\n  `browserslist-stats.json` + an unrelated `browserslist('defaults')` call)\n  now returns a normal result instead of crashing.\n\n### Impact\n- **Who is affected**: Any project whose build/CI invokes Browserslist\n  (directly or via Autoprefixer/Babel/Stylelint/PostCSS) in a directory tree\n  an attacker can place a file into (external PR, compromised dependency),\n  or any app that passes user-influenced data into `opts.stats`.\n- **What an attacker achieves**: Immediate DoS — crashes the invoking\n  process on the first Browserslist call after the file is present, for any\n  query, no special syntax needed.\n- **Conditions required**: No authentication — only the ability to add a\n  file to the project's directory tree, or influence `opts.stats`.\n\n### Verification Environment\nbrowserslist @ HEAD (== v4.28.6, current latest stable release) under local\nNode.js v20.19.5. Pure JS library — executed directly, no server needed.\n\n### Note\nFound via a systematic review of prototype-pollution-adjacent patterns in\nthis codebase after confirming two unrelated algorithmic-complexity issues\n(reported separately as GHSA-rrmg-cfrq-23vv and GHSA-g6p8-hj8g-x889) in the\nsame research pass. A similar `for...in` + bracket-write pattern in\n`index.js`'s `copyObject()` (used by `normalizeAndroidData`) was already\nguarded against `__proto__`/`constructor`/`prototype` keys by a prior,\nunrelated commit — that guard was never applied to this function.","status":"published","published":"2026-09-01T16:41:54Z","modified":"2026-09-01T16:41:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-1321"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-73088","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:16.977Z","modified":"2026-09-09T20:44:04.357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248","CWE-1321"],"updated_at":"2026-11-02T14:12:36.880938Z"}],"osv":[{"id":"CVE-2026-73088","title":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:00:05.869Z","modified":"2026-10-28T02:31:09.266097884Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321","CWE-248"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-73088","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:16.977Z","modified":"2026-10-01T03:03:34.003624612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-73wf-gq98-2v4g","title":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","description":"## Vulnerability Details\n\n**File**: `node.js`\n**Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called\n**unconditionally** on every `browserslist()` call) and `loadStat()`\n\n### Root Cause\n```js\nfunction normalizeStats(data, stats) {\n  if (!data) { data = {} }\n  if (stats \u0026\u0026 'dataByBrowser' in stats) { stats = stats.dataByBrowser }\n  if (typeof stats !== 'object') return undefined\n\n  var normalized = {}\n  for (var i in stats) {\n    var versions = Object.keys(stats[i])\n    if (versions.length === 1 \u0026\u0026 data[i] \u0026\u0026 data[i].versions.length === 1) {\n      var normal = data[i].versions[0]\n      normalized[i] = {}\n      normalized[i][normal] = stats[i][versions[0]]\n    } else {\n      normalized[i] = stats[i]\n    }\n  }\n  return normalized\n}\n```\n`stats` is untrusted: it comes from `JSON.parse()`-ing a\n`browserslist-stats.json` file — auto-discovered by walking up the directory\ntree from the project root **on every `browserslist()` call, regardless of\nthe query** (`env.getStat(opts, browserslist.data)` runs unconditionally\ninside `browserslist()`) — or from `opts.stats` passed programmatically /\nvia the CLI's `--stats=` flag. `data` is `browserslist.data`, a plain object\npopulated only with real browser names.\n\nTwo independent bugs from the same root cause (unguarded `for...in` over\nuntrusted keys used with plain-object bracket access/assignment):\n\n1. **Crash**: `data[i]` has no `hasOwnProperty` guard. If `stats` contains a\n   key that also happens to be an inherited `Object.prototype` member name —\n   `\"__proto__\"`, `\"toString\"`, `\"valueOf\"`, `\"constructor\"`,\n   `\"hasOwnProperty\"`, `\"isPrototypeOf\"`, etc. — `data[i]` resolves to that\n   inherited function/object (always truthy), and the code then does\n   `data[i].versions.length` → `undefined.length` → **uncaught `TypeError`**,\n   for any such key whose JSON value has exactly one sub-key, e.g.:\n   ```json\n   { \"toString\": { \"onekey\": 5 }, \"chrome\": { \"100\": 50 } }\n   ```\n2. **Prototype write**: `normalized[i] = ...` on the fresh\n   `normalized = {}` — if `i` is exactly `\"__proto__\"` (and `normalized` has\n   no own property by that name yet), this computed assignment invokes the\n   real `Object.prototype.__proto__` setter, changing `normalized`'s actual\n   `[[Prototype]]` instead of creating a plain property.\n\nBecause this runs on **every** `browserslist()` call regardless of the\nquery, simply committing a poisoned `browserslist-stats.json` anywhere in a\nproject's directory tree breaks every subsequent Browserslist call in that\nproject — including calls made by Autoprefixer, Babel `preset-env`,\nStylelint, or PostCSS internally, for completely unrelated queries.\n\n### Attack Scenario\n1. Attacker submits a PR (or a compromised dependency) adding a\n   `browserslist-stats.json` file anywhere between the project root and\n   filesystem root, containing e.g.\n   `{\"toString\": {\"onekey\": 5}, \"chrome\": {\"100\": 50}}`.\n2. The victim's build/CI pipeline runs any tool that calls `browserslist()`\n   internally, for **any** query.\n3. The auto-discovered poisoned file crashes the process with an uncaught\n   `TypeError` on the very first call.\n\n### Measured Impact\nConfirmed crash (real `browserslist()` call, v4.28.6) with `stats` keys:\n`__proto__`, `toString`, `valueOf`, `hasOwnProperty`, `constructor`,\n`isPrototypeOf` — each paired with a one-key JSON object — for any query,\nincluding `browserslist('defaults')` which never mentions stats.\n\n### Recommended Fix (implemented and verified)\n```js\nvar normalized = Object.create(null)\nfor (var i in stats) {\n  var versions = Object.keys(stats[i])\n  var known = Object.prototype.hasOwnProperty.call(data, i) \u0026\u0026 data[i]\n  if (versions.length === 1 \u0026\u0026 known \u0026\u0026 known.versions.length === 1) {\n    var normal = known.versions[0]\n    normalized[i] = Object.create(null)\n    normalized[i][normal] = stats[i][versions[0]]\n  } else {\n    normalized[i] = stats[i]\n  }\n}\nreturn normalized\n```\n`normalized` uses `Object.create(null)` so a write to `\"__proto__\"` is an\nordinary property set, never a `[[Prototype]]` change; `data[i]` is replaced\nwith an explicit `hasOwnProperty` check so it never resolves to an inherited\n`Object.prototype` member.\n\n**Verification**:\n- `NODE_ENV=test npx uvu test .test.js` → 301/301 pass unmodified\n  (`test/custom.test.js`, `test/shareable-stats.test.js`, `test/cover.test.js`\n  exercise the stats-handling paths).\n- All 6 previously crash-inducing keys, tested individually, now resolve\n  without error.\n- The realistic file-based auto-discovery scenario (poisoned\n  `browserslist-stats.json` + an unrelated `browserslist('defaults')` call)\n  now returns a normal result instead of crashing.\n\n### Impact\n- **Who is affected**: Any project whose build/CI invokes Browserslist\n  (directly or via Autoprefixer/Babel/Stylelint/PostCSS) in a directory tree\n  an attacker can place a file into (external PR, compromised dependency),\n  or any app that passes user-influenced data into `opts.stats`.\n- **What an attacker achieves**: Immediate DoS — crashes the invoking\n  process on the first Browserslist call after the file is present, for any\n  query, no special syntax needed.\n- **Conditions required**: No authentication — only the ability to add a\n  file to the project's directory tree, or influence `opts.stats`.\n\n### Verification Environment\nbrowserslist @ HEAD (== v4.28.6, current latest stable release) under local\nNode.js v20.19.5. Pure JS library — executed directly, no server needed.\n\n### Note\nFound via a systematic review of prototype-pollution-adjacent patterns in\nthis codebase after confirming two unrelated algorithmic-complexity issues\n(reported separately as GHSA-rrmg-cfrq-23vv and GHSA-g6p8-hj8g-x889) in the\nsame research pass. A similar `for...in` + bracket-write pattern in\n`index.js`'s `copyObject()` (used by `normalizeAndroidData`) was already\nguarded against `__proto__`/`constructor`/`prototype` keys by a prior,\nunrelated commit — that guard was never applied to this function.","status":"published","published":"2026-09-01T16:41:54Z","modified":"2026-09-10T03:51:15.295037659Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321","CWE-248"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RHSA-2026:54517","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:50Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54518","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-14T10:16:47Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-73088","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:00Z","modified":"2026-08-19T11:11:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"CLSA-2026-1790004614","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.14.2-tuxcare.2.","status":"published","published":"2026-09-21T15:30:14Z","modified":"2026-10-15T09:47:08.734817892Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790016470","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.10.0-tuxcare.4.","status":"published","published":"2026-09-21T18:47:50Z","modified":"2026-10-15T09:46:02.494683266Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790175577","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.27.0-tuxcare.2.","status":"published","published":"2026-09-23T14:59:37Z","modified":"2026-10-15T09:48:03.104368116Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790177674","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.13.0-tuxcare.3.","status":"published","published":"2026-09-23T15:34:34Z","modified":"2026-10-15T09:47:56.801925069Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790541831","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 3.2.8-tuxcare.1.","status":"published","published":"2026-09-27T20:43:51Z","modified":"2026-10-15T09:47:38.224603674Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790544273","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 2.11.3-tuxcare.1.","status":"published","published":"2026-09-27T21:24:33Z","modified":"2026-10-15T09:47:38.277569869Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790604921","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 1.7.7-tuxcare.1.","status":"published","published":"2026-09-28T14:15:21Z","modified":"2026-10-15T09:48:03.107458285Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790615783","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.24.4-tuxcare.1.","status":"published","published":"2026-09-28T17:16:23Z","modified":"2026-10-15T09:47:38.375183589Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791199466","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.21.5-tuxcare.1.","status":"published","published":"2026-10-05T11:24:26Z","modified":"2026-10-15T09:47:39.28859623Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792163369","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.24.0-tuxcare.1.","status":"published","published":"2026-10-16T15:09:29Z","modified":"2026-10-16T16:31:39.313295145Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792443101","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.5-tuxcare.1.","status":"published","published":"2026-10-19T20:51:41Z","modified":"2026-10-20T01:45:08.297844633Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792473159","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.28.1-tuxcare.1.","status":"published","published":"2026-10-20T05:12:39Z","modified":"2026-10-20T07:15:08.917971945Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792477554","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.4-tuxcare.1.","status":"published","published":"2026-10-20T06:25:54Z","modified":"2026-10-20T07:15:15.38084078Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792495777","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.2-tuxcare.1.","status":"published","published":"2026-10-20T11:29:37Z","modified":"2026-10-20T13:45:18.46649554Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793180856","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.23.3-tuxcare.1.","status":"published","published":"2026-10-28T09:47:36Z","modified":"2026-10-28T13:45:17.233010071Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793445784","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.0-tuxcare.2.","status":"published","published":"2026-10-31T12:23:05Z","modified":"2026-10-31T14:45:03.694791486Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793445883","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.1-tuxcare.2.","status":"published","published":"2026-10-31T12:24:44Z","modified":"2026-10-31T14:45:02.251551363Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793445987","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.21.10-tuxcare.2.","status":"published","published":"2026-10-31T12:26:27Z","modified":"2026-10-31T14:45:03.048015784Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793446139","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.2-tuxcare.2.","status":"published","published":"2026-10-31T12:29:00Z","modified":"2026-10-31T14:45:03.050955687Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1794048476","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-11-07T11:47:57Z","modified":"2026-11-07T13:15:02.326575687Z","updated_at":"2026-11-07T13:47:00.167603Z"},{"id":"CLSA-2026-1794048573","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.24.5-tuxcare.1.","status":"published","published":"2026-11-07T11:49:34Z","modified":"2026-11-07T13:15:02.339144119Z","updated_at":"2026-11-07T13:47:00.167603Z"},{"id":"openSUSE-SU-2026:11535-1","title":"bun-1.4.0~git20260808.52bf09cb-2.1 on GA media","description":"These are all security issues fixed in the bun-1.4.0~git20260808.52bf09cb-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-08-19T18:23:34.189601839Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11540-1","title":"python313-pytest-html-4.2.0-5.1 on GA media","description":"These are all security issues fixed in the python313-pytest-html-4.2.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-08-19T18:23:34.412857428Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21602-1","title":"Security update for python-pytest-html","description":"This update for python-pytest-html fixes the following issues:\n\nChanges in python-pytest-html:\n\n- Revendor browserslist to fix the following:\n  * CVE-2026-73088: unguarded for...in loop over untrusted JSON keys in normalizeStats() function leads to prototype pollution and uncaught exceptions (bsc#1275374)\n  * CVE-2026-73089: unbounded in-memory caching of query pairs in browserslist() can lead to DoS via memory exhaustion through a high volume of distinct queries (bsc#1275437)\n","status":"published","published":"2026-08-18T15:53:05Z","modified":"2026-08-21T09:15:07.245549505Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-NPM-CVE-2026-73088","title":"CVE-2026-73088 in browserslist - Patched by Root","description":"Root has patched CVE-2026-73088 in the browserslist package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-23T14:51:12Z","modified":"2026-09-23T15:15:03.252672176Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}