Listen to this Post
to CVE-2025-38839
CVE-2025-38839 is a vulnerability discovered in the popular Browserslist library (versions prior to 4.28.6) that combines two critical weaknesses: an uncaught TypeError crash and a prototype pollution vector, both stemming from the same insecure handling of untrusted input in the `normalizeStats()` function.
The root cause lies in how Browserslist processes statistics data. The `normalizeStats()` function is called unconditionally on every `browserslist()` invocation through getStat(), which loads statistics from either a local `browserslist-stats.json` file or the `opts.stats` parameter. This JSON file is auto-discovered by walking up the directory tree from the project root, meaning any file placed anywhere in the hierarchy will be parsed and processed without validation.
The function iterates over user-controlled keys using a `for…in` loop without a `hasOwnProperty` guard. This leads to two distinct bugs:
First, when `stats` contains a key that matches an inherited `Object.prototype` member (such as "__proto__", "toString", "valueOf", "constructor", "hasOwnProperty", or "isPrototypeOf"), the code attempts to access data
.versions.length</code>. Since `data[bash]` resolves to the inherited function or object rather than a plain property, accessing `.versions` on a function returns <code>undefined</code>, and calling `.length` on `undefined` throws an uncaught <code>TypeError</code>, crashing the entire process.
Second, on the fresh object <code>normalized = {}</code>, an assignment `normalized[bash] = ...` where `i` is exactly `"__proto__"` triggers the real `Object.prototype.__proto__` setter, altering the object's actual prototype instead of creating a plain property. This prototype pollution can have cascading effects on the application's behavior.
Because the vulnerable code runs on every Browserslist call regardless of the query, an attacker can permanently break a project's build or CI pipeline by adding a single malicious `browserslist-stats.json` file. This affects any tool that uses Browserslist internally, including Autoprefixer, Babel preset-env, Stylelint, and PostCSS, making this a high-severity denial-of-service vulnerability with potential for broader prototype pollution attacks.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Node.js
Version: v4.28.6
Vulnerability: Prototype Pollution DoS
Severity: High
Date: 2026-06-01
<h2 style="color: blue;">Prediction: 2026-06-04</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
The `normalizeStats()` function in Browserslist v4.28.6 processes untrusted JSON from `browserslist-stats.json` without proper key validation. This enables both crash-based denial of service via prototype method keys and prototype pollution via `__proto__` writes. The fix implements `Object.create(null)` and explicit `hasOwnProperty` checks.
[bash]
Test for CVE-2025-38839
echo '{"toString":{"onekey":5},"chrome":{"100":50}}' > browserslist-stats.json
npx browserslist "defaults"
Expected: Uncaught TypeError before fix, normal output after fix
Exploit: (Educational Purposes!)
Create a malicious `browserslist-stats.json` file:
{"toString": {"onekey": 5}, "chrome": {"100": 50}}
Place it in any directory between project root and filesystem root. Run any Browserslist query (e.g., npx browserslist "defaults"). The process crashes with:
TypeError: Cannot read properties of undefined (reading 'length')
Alternatively, use `"__proto__": {"polluted": true}` to pollute the prototype of the `normalized` object.
Protection:
- Upgrade to Browserslist v4.28.6 or later where `normalizeStats()` uses `Object.create(null)` and explicit `hasOwnProperty` checks.
- Validate and sanitize all JSON input passed to `opts.stats` or loaded from `browserslist-stats.json` files.
- Use `JSON.parse()` with a reviver function to filter out dangerous keys.
- Implement file integrity checks for `browserslist-stats.json` in CI/CD pipelines.
- Consider using `--no-stats` CLI flag if statistics are not required.
Impact:
- Immediate denial of service via uncaught TypeError crashes.
- Prototype pollution allowing potential property injection.
- Affects all tools using Browserslist (Autoprefixer, Babel, Stylelint, PostCSS).
- Exploitable via PR submissions or compromised dependencies.
- No authentication required; only file write access needed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
