Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T17:19:16.977Z",
  "pubdate": "2026-08-11T17:19:16.977Z",
  "executiveSummary": "Browserslist prior to version 4.28.7 contains a prototype pollution and type error vulnerability affecting the normalization of statistical data.\nThe vulnerability arises from the insecure processing of untrusted input data via browserslist-stats.json, opts.stats, and CLI --stats parameters.\nImpact includes application instability through uncaught TypeErrors and potential prototype modification of the returned normalized object, potentially compromising downstream object integrity.\nAffected systems include any environment utilizing vulnerable versions of the Browserslist package where external or untrusted statistical payloads are ingested.\nAttackers capable of supplying malicious configuration files or command-line arguments can trigger the flaw unconditionally on every browserslist() execution.\nThe risk is mitigated by updating the Browserslist package to version 4.28.7 or later, where proper safeguards are implemented.",
  "technicalDetails": "The root cause of the vulnerability resides in the normalizeStats() function located within node.js of the Browserslist package.\nThe function is reached unconditionally through getStat() and loadStat() during every browserslist() call, processing untrusted input vectors including browserslist-stats.json, opts.stats, and CLI --stats data.\nData processing utilizes an unguarded for...in loop paired with plain-object bracket access and assignment.\nThis insecure iteration pattern allows inherited Object.prototype keys—such as __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf—to be processed directly.\nStep-by-step exploitation occurs as follows: an attacker supplies a crafted JSON payload or command-line input containing malicious prototype keys; the vulnerable normalizeStats() function iterates over these keys using an unguarded for...in loop without verifying own-properties via hasOwnProperty checks; the subsequent bracket assignment interacts directly with Object.prototype.\nThis interaction either injects properties into the prototype chain leading to prototype pollution or triggers unexpected runtime behavior resulting in an uncaught TypeError.\nThe vulnerable component is the normalization logic within Browserslist versions prior to 4.28.7.\nAuthentication and privilege requirements depend on the execution context, typically requiring the ability to supply or influence configuration files, options, or command-line arguments processed by the application.\nThe flaw manifests locally or wherever untrusted statistical configurations are parsed within the Node.js runtime environment."
}