medium5.3
CVE-2026-44292
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
Impact
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | protobufjs | <= 7.5.5 | 7.5.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Protobufjs Project | Protobufjs | before 7.5.6 from 8.0.0 before 8.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-fx83-v9x8-x52w
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-44292