CVE-2026-73088: 
Grafana vulnerability analysis and mitigation

CVE-2026-73088 is a prototype pollution and uncaught exception vulnerability in the Browserslist npm package, a widely used configuration tool for sharing target browser and Node.js version settings across front-end tooling. The vulnerability exists in the normalizeStats() function in node.js and affects all versions prior to 4.28.7. It was disclosed on July 21, 2026 via a GitHub Security Advisory and published to NVD on August 11, 2026. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is an unguarded for...in loop over untrusted input in normalizeStats() (CWE-1321: Prototype Pollution; CWE-248: Uncaught Exception; CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes). The function processes data from auto-discovered browserslist-stats.json files, opts.stats, or the CLI --stats flag without sanitizing keys. Two distinct bugs arise: (1) if a stats key matches an inherited Object.prototype member (e.g., toString, valueOf, hasOwnProperty), the expression data[i].versions.length resolves to undefined.length, throwing an uncaught TypeError; (2) if the key is exactly __proto__, the assignment normalized[i] = ... invokes the Object.prototype.__proto__ setter, silently mutating the prototype of the returned object. Because getStat() and loadStat() are called unconditionally on every browserslist() invocation, a poisoned stats file in any ancestor directory of the project root will crash every subsequent Browserslist call, including those made internally by Autoprefixer, Babel preset-env, Stylelint, and PostCSS (GitHub Advisory, Fix Commit).

Successful exploitation results in a denial of service (DoS) by crashing the Node.js process with an uncaught TypeError on the first browserslist() call after a poisoned stats file is present, disrupting any build or CI pipeline that depends on Browserslist or its downstream consumers (Autoprefixer, Babel, Stylelint, PostCSS). There is no confidentiality impact, but the prototype pollution variant could theoretically alter the behavior of the returned normalized object, affecting integrity of browser targeting logic. The availability impact is rated High, as the crash is immediate and requires no special query or configuration to trigger (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies the exploitation status as "poc" and the vulnerability as automatable, reflecting the low barrier to triggering the crash. The EPSS score is approximately 0.0036 (0.36%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target project: Find a project that uses Browserslist directly or via a dependent tool (Autoprefixer, Babel preset-env, Stylelint, PostCSS) running a vulnerable version (≤ 4.28.6).
2. Gain write access to the directory tree: Submit a pull request, contribute a compromised dependency, or otherwise place a file anywhere between the project root and the filesystem root — no authentication to the application is required.
3. Craft a malicious browserslist-stats.json: Create a stats file with a key matching an inherited Object.prototype member paired with a single-key sub-object, for example:

   {"toString": {"onekey": 5}, "chrome": {"100": 50}}

4. Trigger the crash: Wait for or cause any tool in the build/CI pipeline to invoke browserslist() for any query (e.g., browserslist('defaults')). The auto-discovery mechanism will find the poisoned file by walking up the directory tree and pass it to normalizeStats(), which will throw an uncaught TypeError and crash the process immediately (GitHub Advisory).

• File System: Presence of an unexpected or newly added browserslist-stats.json file in any directory between the project root and the filesystem root, particularly one containing keys such as __proto__, toString, valueOf, constructor, hasOwnProperty, or isPrototypeOf at the top level.
• Logs: Node.js process crash logs or CI pipeline failure logs showing an uncaught TypeError originating from normalizeStats() in node.js (around line 214) during a Browserslist, Autoprefixer, Babel, Stylelint, or PostCSS invocation.
• Process: Unexpected termination of build or CI processes immediately upon invoking any tool that calls browserslist() internally, with no changes to the query or configuration (GitHub Advisory).

Upgrade Browserslist to version 4.28.7 or later, which fixes the issue by using Object.create(null) for the normalized object (preventing __proto__ setter invocation) and replacing the unsafe data[i] access with an explicit Object.prototype.hasOwnProperty.call(data, i) check (Fix Commit, Release 4.28.7). As a workaround prior to patching, restrict write access to the project directory tree to prevent untrusted parties from placing a browserslist-stats.json file, and validate or sanitize any external data passed via opts.stats or the CLI --stats flag before it reaches Browserslist. Red Hat has also issued security advisories (RHSA-2026:54517, RHSA-2026:54518) for affected Red Hat products (Red Hat).

Red Hat tracked the issue as a high-severity bug (Bugzilla #2514177) and issued multiple errata (RHSA-2026:54517, RHSA-2026:54518) for affected products, indicating broad downstream impact across the Red Hat ecosystem (Red Hat Bugzilla, Red Hat). The vulnerability was discovered by researcher iaohkut-from-NightWolf-Team during a systematic review of prototype-pollution-adjacent patterns in the Browserslist codebase, following identification of two related algorithmic-complexity issues in the same research pass (GitHub Advisory). AUSCERT and INCIBE also published early-warning bulletins, reflecting the wide adoption of Browserslist across the JavaScript ecosystem.