Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
django-jet-3-calm 5.5.2 is out 🔒 security patch: browserslist → 4.28.9 (CVE-2026-73088) and decode-uri-component pinned to 0.5.0 (ReDoS, CVE-2026-45822) drop-in upgrade, no breaking changes
Post summary
The tweet announces a release of django‑jet‑3‑calm 5.5.2 that includes security patches for CVE‑2026‑73088 and CVE‑2026‑45822 via updated dependencies, with no active exploitation or PoC disclosed.
DID YOU KNOW? n8n 1.123.76 bumps browserslist to 4.28.7, fixing CVE-2026-73088 and CVE-2026-73089. Update your n8n instance to close this security gap. https://github.com/n8n-io/n8n/releases/tag/n8n%401.123.76
Post summary
n8n version 1.123.76 includes a patch that addresses CVE-2026-73088 and CVE-2026-73089; users are advised to update to mitigate the vulnerability.
CVE-2026-73088 Browserslist 4.28.7 Fixes Prototype Pollution via Untrusted Stats Data https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73088
Post summary
The text announces that version 4.28.7 of Browserslist resolves the prototype‑pollution vulnerability (CVE‑2026‑73088) caused by untrusted stats data, providing a patch.