Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Description

File: node.js Function: normalizeStats() (line ~214), reached from getStat() (called unconditionally on every browserslist() call) and loadStat()

Recommendation

Update the browserslist package to the latest compatible version. Followings are version details:

Affected version(s): <= 4.28.6
Patched version(s): 4.28.7

References

GHSA-73wf-gq98-2v4g
CVE-2026-73088
CWE-1321
CWE-248
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) and gives you actionable findings to investigate.

Start a free scan

Related Issues

seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
joi: Prototype pollution via a `__proto__` language key in custom messages - @hapi/joi - CVE-2026-84368
joi: Prototype pollution via a `__proto__` language key in custom messages - CVE-2026-84368
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated September 01, 2026