What is the CVSS score of CVE-2026-73088?

CVE-2026-73088 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Browserslist are affected by CVE-2026-73088?

Browserslist versions prior to 4.28.7 are vulnerable to denial-of-service attacks that can crash Node.js application processes through malicious configuration data.. A patch is available.

How to fix or mitigate CVE-2026-73088?

Within 24 hours: conduct a complete inventory of applications and CI/CD pipelines using Browserslist prior to 4.28.7, documenting which systems accept untrusted stats input sources through configuration files, CLI arguments, or environment parameters. Within 7 days: upgrade all affected instances to Browserslist 4.28.7, prioritizing production environments and public-facing services; implement input validation as an interim control if upgrade blockers exist. Within 30 days: verify completion through automated dependency scanning tools, ensure no legacy versions remain in build pipelines or container images, and establish continuous monitoring for future Browserslist security advisories.

Browserslist CVE-2026-73088

EUVD-2026-56285 HIGH

Uncaught Exception (CWE-248)

2026-08-11 security-advisories@github.com

Information Disclosure Node.js Red Hat Suse

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.2 HIGH

Network-supplied stats data allows unauthenticated exploitation; prototype mutation adds limited integrity impact beyond the availability crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 17:45 vuln.today

Analysis Generated

Aug 11, 2026 - 17:45 vuln.today

CVE Published

Aug 11, 2026 - 17:19 cve.org

HIGH 7.5

DescriptionCVE.org

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Articles & Coverage 1

News 6 New Node.js Vulnerabilities - 6 High Severity Patched Aug 12, 2026

AnalysisAI

Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js processes or corrupt object prototypes by supplying crafted stats data to the unconditionally-called normalizeStats() function. Any application that invokes browserslist() with attacker-influenced browserslist-stats.json, opts.stats, or CLI --stats input is at risk of an uncaught TypeError or object prototype modification. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Supply crafted stats JSON with `__proto__` key

Delivery

Application calls `browserslist()` with attacker-controlled stats

Exploit

`normalizeStats()` iterates via unguarded `for...in`

Execution

Bracket assignment writes to Object.prototype

Persist

Uncaught TypeError thrown

Impact

Node.js process crashes

Access

Supply crafted stats JSON with `__proto__` key

Delivery

Application calls `browserslist()` with attacker-controlled stats

Exploit

`normalizeStats()` iterates via unguarded `for...in`

Execution

Bracket assignment writes to Object.prototype

Persist

Uncaught TypeError thrown

Impact

Node.js process crashes

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the consuming application processes attacker-controlled stats data via one of three paths: a `browserslist-stats.json` file the attacker can write to or influence on the server filesystem; the `opts.stats` parameter in a programmatic `browserslist()` API call where user-supplied values flow into that parameter without sanitization; or the `--stats` CLI flag in an environment where an attacker controls command-line arguments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H assigns a 7.5 base score reflecting high availability impact with no authentication barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can supply or overwrite the `browserslist-stats.json` file consumed by a Node.js application, or who can inject values into the `opts.stats` parameter through an exposed API, crafts a JSON payload containing `__proto__` as a top-level key. When `normalizeStats()` processes this payload via the unguarded `for...in` loop, it attempts a bracket assignment onto the object prototype, either corrupting `Object.prototype` for the process or triggering an uncaught TypeError that crashes the Node.js worker. …
Remediation	Upgrade to Browserslist version 4.28.7, which fully resolves the issue as confirmed by the GitHub release tag and commit f9914ad9effc865ccc27d816255625890b31ca51. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: conduct a complete inventory of applications and CI/CD pipelines using Browserslist prior to 4.28.7, documenting which systems accept untrusted stats input sources through configuration files, CLI arguments, or environment parameters. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2015-5688 MEDIUM This Month POC

5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2014-7192 CRITICAL Act Now POC

10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

Same weakness CWE-248 – Uncaught Exception

View all

CVE-2013-10065 HIGH POC

8.7

CVE-2026-62909 HIGH POC

7.8

CVE-2023-0790 HIGH POC

8.8

CVE-2026-53530 HIGH POC

8.7

CVE-2024-8249 HIGH POC

7.5

CVE-2024-8020 HIGH POC

7.5

CVE-2025-59538 HIGH POC

7.5

CVE-2026-34986 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 12	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2026-73088 vulnerability details – vuln.today

Back

Browserslist CVE-2026-73088

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Node.js

Same weakness CWE-248 – Uncaught Exception

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code