High [CVE-2026-73088] Prototype pollution leading to denial of service
This high-severity Red Hat Linux advisory covers CVE-2026-73088 affecting Red Hat Hardened Images, Cryostat 4, Gatekeeper 3.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object.
This issue is fixed in version 4.28.7. An attacker could provide specially crafted statistics data, which the tool processes without proper validation.
This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service. This is an Important vulnerability.
The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-915.
- < 4.28.7
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
- 4.28.7
- grafana13-1-main-13.1.3-0.1.1.hum1
- grafana12-4-main-12.4.8-0.1.1.hum1
- RHSA-2026:54517
- RHSA-2026:54518
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation checklist
- To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.