CVE-2026-44288 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.
A vulnerability exists in protobufjs versions prior to 7.5.6 and 8.0.2, where the library's UTF-8 decoder improperly handled overlong byte sequences. Instead of rejecting these sequences, the decoder converted them to their canonical characters. This flaw allows an attacker to manipulate protobuf binary data, potentially bypassing application-level checks that examine raw bytes before decoding strings. The issue is particularly relevant in contexts where decoded strings are used in security-sensitive situations.
Users can upgrade to protobufjs versions 7.5.6 or 8.0.2. For applications using the @protobufjs/utf8 package, version 1.1.1 is available. It is also recommended to validate decoded strings in security-sensitive contexts and to use native UTF-8 decoding when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-176 | Improper Handling of Unicode Encoding | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | < 7.5.6 >= 8.0.0, < 8.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |