AIKIDO-2026-842415

TL;DR

The normalizeStats function in node.js iterates untrusted custom stats with an unguarded for...in loop and uses plain-object bracket access and assignment on keys taken from a browserslist-stats.json file or opts.stats. A key matching an inherited Object.prototype member such as __proto__, toString, or constructor makes a data lookup resolve to an inherited function and throws an uncaught TypeError, while a literal __proto__ key invokes the real prototype setter and rewrites the object prototype. Because custom stats are auto-discovered by walking the directory tree and are read on every browserslist() call regardless of the query, a single poisoned file anywhere in the project tree crashes every downstream tool that invokes Browserslist. The fix normalizes into an Object.create(null) object and guards data lookups with an explicit hasOwnProperty check so untrusted keys can no longer reach inherited members or the prototype setter.