THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-73wf-gq98-2v4g (high) — Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

[GHSA] GHSA-73wf-gq98-2v4g (high) — Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

medgithub_advisoriesPublished 2026-09-01

GHSA-73wf-gq98-2v4g Severity: high CVE: CVE-2026-73088

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

## Vulnerability Details

**File**: `node.js` **Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called **unconditionally** on every `browserslist()` call) and `loadStat()`

### Root Cause ```js function nor

Indicators of compromise

Original source: https://github.com/advisories/GHSA-73wf-gq98-2v4g