Description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| browserslist | browserslist | < 4.28.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-browserslist | 4.28.7+~cs8.16.65-1 | — |
| Debian 13 | node-browserslist | No fix yet | — |
| Debian 12 | node-browserslist | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 24.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 22.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 20.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 18.04 LTS | node-browserslist | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.1.hum1 | RHSA-2026:54518 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.1.hum1 | RHSA-2026:54517 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
| openSUSE Tumbleweed | bun | 1.4.0~git20260808.52bf09cb-2.1 | openSUSE-SU-2026:11535-1 |
| openSUSE Tumbleweed | python-pytest-html | 4.2.0-5.1 | openSUSE-SU-2026:11540-1 |
| openSUSE Leap 16.0 | python-pytest-html | 4.1.1-bp160.5.1 | openSUSE-SU-2026:21602-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.11-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-suggestion-hyperopt | 0.19.0-r40 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.7-r4 | — |
| Wolfi rolling | ts-patch | 4.0.1-r44 | — |
| Wolfi rolling | vitess-23 | 23.0.6-r3 | — |
| Wolfi rolling | vitess-24 | 24.0.3-r1 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | browserslist | < 4.28.7 | 4.28.7 | GHSA-73wf-gq98-2v4g |
Advisories 7
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:54517 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54518 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
- openSUSE-SU-2026:21602-1 Security update for python-pytest-html SUSE / openSUSE Security Updates · Aug 21, 2026
- openSUSE-SU-2026:11535-1 bun-1.4.0~git20260808.52bf09cb-2.1 on GA media SUSE / openSUSE Security Updates · Aug 19, 2026
- openSUSE-SU-2026:11540-1 python313-pytest-html-4.2.0-5.1 on GA media SUSE / openSUSE Security Updates · Aug 19, 2026