CVE-2026-44290 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
A denial-of-service vulnerability has been identified in protobufjs versions prior to 7.5.6 and 8.0.2. The issue arises because protobufjs allowed certain schema option paths to traverse inherited object properties while applying options. This could lead to option handling writing to properties on global JavaScript constructors, corrupting built-in functionality across the process. The vulnerability is exploitable when an application loads or parses protobuf schemas or JSON descriptors from untrusted sources using protobufjs reflection APIs.
Users can upgrade to protobufjs versions 7.5.6 or 8.0.2 to address this vulnerability. If untrusted schemas must be accepted, it is recommended to validate or reject option names containing unsafe property path components before loading them, and to run schema processing in an isolated process.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | < 7.5.6 >= 8.0.0, < 8.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |