CVE-2026-54269
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.
Risk Assessment
Organizations may be exposed to errors in data processing and unpredictable application behavior, potentially leading to serious data integrity issues.
Recommendation
It is recommended to update protobufjs to version 8.6.0 or 7.6.3 to eliminate this vulnerability and minimize the risk associated with application errors.
Other vulnerabilities in protobufjs
See all- CVE-2026-41242Critical
A vulnerability in the protobufjs library allows arbitrary JavaScript code injection via 'type' fields in protobuf definitions. The code executes during object decoding. The issue is fixed in versions 8.0.1 and 7.5.5.
- CVE-2026-59877Medium
A vulnerability in the protobufjs library allows infinite looping when parsing specially crafted .proto files. The lack of end-of-input checking when processing options causes parse, Root.load, or Root.loadSync to loop indefinitely.
- CVE-2026-59876Medium
A vulnerability in the protobufjs library (versions 8.2.0 to 8.6.5) allows prototype pollution via parsing map entries in Text Format. An attacker can inject a map key named __proto__, which modifies the object prototype instead of creating a map entry.
- CVE-2026-54270Medium
Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.
- CVE-2026-44293High
protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.
- CVE-2026-44289High
Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.
Original NVD description (English source)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.