chore(deps): update dependency browserslist to v4.28.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
browserslist	4.28.2 → 4.28.7

---

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

CVE-2026-73088 / GHSA-73wf-gq98-2v4g

More information

Details

Vulnerability Details

File: node.js
Function: normalizeStats() (line ~214), reached from getStat() (called
unconditionally on every browserslist() call) and loadStat()

Root Cause

function normalizeStats(data, stats) {
  if (!data) { data = {} }
  if (stats && 'dataByBrowser' in stats) { stats = stats.dataByBrowser }
  if (typeof stats !== 'object') return undefined

  var normalized = {}
  for (var i in stats) {
    var versions = Object.keys(stats[i])
    if (versions.length === 1 && data[i] && data[i].versions.length === 1) {
      var normal = data[i].versions[0]
      normalized[i] = {}
      normalized[i][normal] = stats[i][versions[0]]
    } else {
      normalized[i] = stats[i]
    }
  }
  return normalized
}

stats is untrusted: it comes from JSON.parse()-ing a
browserslist-stats.json file — auto-discovered by walking up the directory
tree from the project root on every browserslist() call, regardless of
the query (env.getStat(opts, browserslist.data) runs unconditionally
inside browserslist()) — or from opts.stats passed programmatically /
via the CLI's --stats= flag. data is browserslist.data, a plain object
populated only with real browser names.

Two independent bugs from the same root cause (unguarded for...in over
untrusted keys used with plain-object bracket access/assignment):

1. Crash: data[i] has no hasOwnProperty guard. If stats contains a
   key that also happens to be an inherited Object.prototype member name —
   "__proto__", "toString", "valueOf", "constructor",
   "hasOwnProperty", "isPrototypeOf", etc. — data[i] resolves to that
   inherited function/object (always truthy), and the code then does
   data[i].versions.length → undefined.length → uncaught TypeError,
   for any such key whose JSON value has exactly one sub-key, e.g.:

   { "toString": { "onekey": 5 }, "chrome": { "100": 50 } }

2. Prototype write: normalized[i] = ... on the fresh
   normalized = {} — if i is exactly "__proto__" (and normalized has
   no own property by that name yet), this computed assignment invokes the
   real Object.prototype.__proto__ setter, changing normalized's actual
   [[Prototype]] instead of creating a plain property.

Because this runs on every browserslist() call regardless of the
query, simply committing a poisoned browserslist-stats.json anywhere in a
project's directory tree breaks every subsequent Browserslist call in that
project — including calls made by Autoprefixer, Babel preset-env,
Stylelint, or PostCSS internally, for completely unrelated queries.

Attack Scenario

1. Attacker submits a PR (or a compromised dependency) adding a
   browserslist-stats.json file anywhere between the project root and
   filesystem root, containing e.g.
   {"toString": {"onekey": 5}, "chrome": {"100": 50}}.
2. The victim's build/CI pipeline runs any tool that calls browserslist()
   internally, for any query.
3. The auto-discovered poisoned file crashes the process with an uncaught
   TypeError on the very first call.

Measured Impact

Confirmed crash (real browserslist() call, v4.28.6) with stats keys:
__proto__, toString, valueOf, hasOwnProperty, constructor,
isPrototypeOf — each paired with a one-key JSON object — for any query,
including browserslist('defaults') which never mentions stats.

Recommended Fix (implemented and verified)

var normalized = Object.create(null)
for (var i in stats) {
  var versions = Object.keys(stats[i])
  var known = Object.prototype.hasOwnProperty.call(data, i) && data[i]
  if (versions.length === 1 && known && known.versions.length === 1) {
    var normal = known.versions[0]
    normalized[i] = Object.create(null)
    normalized[i][normal] = stats[i][versions[0]]
  } else {
    normalized[i] = stats[i]
  }
}
return normalized

normalized uses Object.create(null) so a write to "__proto__" is an
ordinary property set, never a [[Prototype]] change; data[i] is replaced
with an explicit hasOwnProperty check so it never resolves to an inherited
Object.prototype member.

Verification:

• NODE_ENV=test npx uvu test .test.js → 301/301 pass unmodified
  (test/custom.test.js, test/shareable-stats.test.js, test/cover.test.js
  exercise the stats-handling paths).
• All 6 previously crash-inducing keys, tested individually, now resolve
  without error.
• The realistic file-based auto-discovery scenario (poisoned
  browserslist-stats.json + an unrelated browserslist('defaults') call)
  now returns a normal result instead of crashing.

Impact

• Who is affected: Any project whose build/CI invokes Browserslist
  (directly or via Autoprefixer/Babel/Stylelint/PostCSS) in a directory tree
  an attacker can place a file into (external PR, compromised dependency),
  or any app that passes user-influenced data into opts.stats.
• What an attacker achieves: Immediate DoS — crashes the invoking
  process on the first Browserslist call after the file is present, for any
  query, no special syntax needed.
• Conditions required: No authentication — only the ability to add a
  file to the project's directory tree, or influence opts.stats.

Verification Environment

browserslist @​ HEAD (== v4.28.6, current latest stable release) under local
Node.js v20.19.5. Pure JS library — executed directly, no server needed.

Note

Found via a systematic review of prototype-pollution-adjacent patterns in
this codebase after confirming two unrelated algorithmic-complexity issues
(reported separately as GHSA-rrmg-cfrq-23vv and GHSA-g6p8-hj8g-x889) in the
same research pass. A similar for...in + bracket-write pattern in
index.js's copyObject() (used by normalizeAndroidData) was already
guarded against __proto__/constructor/prototype keys by a prior,
unrelated commit — that guard was never applied to this function.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g
• https://nvd.nist.gov/vuln/detail/CVE-2026-73088
• https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51
• https://github.com/browserslist/browserslist/releases/tag/4.28.7
• https://github.com/advisories/GHSA-73wf-gq98-2v4g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

browserslist/browserslist (browserslist)

v4.28.7

Compare Source

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

v4.28.6

Compare Source

• Fixed Electron version queries (by @​spokodev).

v4.28.5

Compare Source

• Fixed > and >= queries (by @​spokodev).

v4.28.4

Compare Source

• Fixed SyntaxError regression of 4.28.3.

v4.28.3

Compare Source

• Fixed baseline query case-insensitivity (by @​swwind).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ui-kit	Ready	Preview	Sep 7, 2026 8:22am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9221e60

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ct-changesets]

⚠️ No changeset was automatically added for this dependency update. Please add one manually if this change should be released.