protobufjs vulnerabilities

Products

• protobuf.js 16
• @protobufjs/utf8 1
• protobufjs-cli 1

Latest protobufjs CVEs

Newest publication first

1. CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype

   Published 2026-07-08

   Medium·CVSS 4.8 EPSS 0.35%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned ma...

2. CVE-2026-59877 protobufjs: Denial of Service via infinite loop in .proto option parsing

   Published 2026-07-08

   High·CVSS 7.5 EPSS 0.37%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declar...

3. CVE-2026-54269 protobufjs: Schema-derived names can shadow runtime-significant properties

   Published 2026-06-22

   Medium·CVSS 5.3 EPSS 0.40%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, fie...

4. CVE-2026-48712 protobufjs: Denial of service through unbounded Any expansion during JSON conversion

   Published 2026-06-22

   High·CVSS 7.5 EPSS 0.46%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protob...

5. CVE-2026-54270 protobufjs: Memory amplification from preserved unknown fields in binary decode

   Published 2026-06-22

   Medium·CVSS 5.3 EPSS 0.40%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload conta...

6. CVE-2026-54271 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

   Published 2026-06-22

   High·CVSS 8.2 EPSS 0.30%

   protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when gener...

7. CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.40%

   protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain name...

8. CVE-2026-42290 protobufjs-cli: OS Command Injection

   Published 2026-05-13

   High·CVSS 7.8 EPSS 0.13%

   protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted...

9. CVE-2026-45740 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

   Published 2026-05-13

   High·CVSS 7.5 EPSS 0.26%

   protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested...

10. CVE-2026-44294 protobufjs: Denial of service from crafted field names in generated code

    Published 2026-05-13

    Medium·CVSS 5.3 EPSS 0.43%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded int...

11. CVE-2026-44293 protobufjs: Code injection through bytes field defaults in generated toObject code

    Published 2026-05-13

    High·CVSS 7.7 EPSS 0.41%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a no...

12. CVE-2026-44292 protobufjs: Prototype injection in generated message constructors

    Published 2026-05-13

    Medium·CVSS 5.3 EPSS 0.26%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the proto key. If an application constructed a message fro...

13. CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution

    Published 2026-05-13

    High·CVSS 8.1 EPSS 0.50%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted,...

14. CVE-2026-44290 protobufjs: Process-wide denial of service through unsafe option paths

    Published 2026-05-13

    High·CVSS 7.5 EPSS 0.37%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause optio...

15. CVE-2026-44289 protobufjs: Denial of service through unbounded protobuf recursion

    Published 2026-05-13

    High·CVSS 7.5 EPSS 0.63%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields....

16. CVE-2026-44288 protobufjs: Overlong UTF-8 decoding

    Published 2026-05-13

    Medium·CVSS 5.3 EPSS 0.30%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can...

17. CVE-2026-41242 protobufjs has an arbitrary code execution issue

    Published 2026-04-18

    Critical·CVSS 9.4 EPSS 0.77%

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.