CVE-2026-44291 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
A vulnerability in protobufjs versions prior to 7.5.6 and 8.0.2 allows for prototype pollution, which can be exploited to execute arbitrary JavaScript code. This issue arises because protobufjs used plain objects with inherited prototypes for internal type lookup tables. If Object.prototype had been polluted, these lookup tables could misinterpret attacker-controlled inherited properties as valid protobuf type information. Consequently, strings controlled by an attacker could be injected into the generated JavaScript code. The vulnerability requires a separate prototype pollution exploit to be triggered before protobufjs is used, and applications must be processing untrusted input that can affect Object.prototype.
Users can upgrade to protobufjs versions 7.5.6 or 8.0.2 to address this vulnerability. If an immediate upgrade is not feasible, it is recommended to remove or mitigate any reachable prototype pollution primitives and isolate schema or message processing from untrusted application state.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | < 7.5.6 >= 8.0.0, < 8.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |