The vulnerability CVE-2026-73088 affects the Browserslist component included in Red Hat Hardened Images RPMs, notably grafana13.1-13.1.3-0.1.1.hum1. It is a prototype pollution flaw caused by improper validation of untrusted statistics data input, which can lead to denial of service by crashing applications that use the affected library. The issue is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-770. The vulnerability can be exploited remotely without authentication or user interaction, impacting availability. Red Hat's advisory (RHSA-2026:54517) confirms the issue and recommends restricting Browserslist to trusted input sources. No explicit patch version or fixed release is mentioned in the advisory, and the vendor guidance focuses on input validation and cautious use of the tool.

The vulnerability allows remote attackers to cause denial of service by crashing applications that use the Browserslist tool with specially crafted untrusted statistics data. There is no impact on confidentiality or integrity reported. The flaw can be exploited without authentication or user interaction, directly affecting service availability. No known exploits in the wild have been reported.

Red Hat advises ensuring that Browserslist processes only trusted statistics data sources such as browserslist-stats.json, opts.stats, and CLI --stats data. Avoid using Browserslist with untrusted input in development or build environments. Validate that all input data originates from trusted sources, especially in automated pipelines. Since no explicit patch or fixed version is stated, these mitigations are critical to reduce exposure. Users should monitor Red Hat advisories for any future updates or patches.