CVE-2026-59876
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in the protobufjs library (versions 8.2.0 to 8.6.5) allows prototype pollution via parsing map entries in Text Format. An attacker can inject a map key named __proto__, which modifies the object prototype instead of creating a map entry.
Risk Assessment
The risk involves potential modification of JavaScript object prototypes, which could lead to remote code execution (RCE) or privilege escalation in applications using protobufjs to parse untrusted Text Format data.
Recommendation
Immediately update protobufjs to version 8.6.5 or later. If an update is not possible, avoid parsing untrusted data in Text Format.
Other vulnerabilities in protobufjs
See all- CVE-2026-41242Critical
A vulnerability in the protobufjs library allows arbitrary JavaScript code injection via 'type' fields in protobuf definitions. The code executes during object decoding. The issue is fixed in versions 8.0.1 and 7.5.5.
- CVE-2026-59877Medium
A vulnerability in the protobufjs library allows infinite looping when parsing specially crafted .proto files. The lack of end-of-input checking when processing options causes parse, Root.load, or Root.loadSync to loop indefinitely.
- CVE-2026-54270Medium
Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.
- CVE-2026-54269Medium
In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.
- CVE-2026-44293High
protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.
- CVE-2026-44289High
Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.
Original NVD description (English source)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.