CVE-2026-44292 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
A prototype injection vulnerability has been identified in protobufjs versions prior to 7.5.6 and 8.0.2. The issue arises because the library's message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. This flaw allows an attacker to manipulate the prototype of individual message instances by including an own enumerable __proto__ property in a plain object passed to the constructor. The vulnerability is not present in applications that only decode binary protobuf data or that construct messages from trusted, application-defined objects.
Users can upgrade to protobufjs versions 7.5.6 or 8.0.2 to address this vulnerability. If untrusted JSON input must be accepted, it is advisable to validate or sanitize object keys before constructing messages, and to reject __proto__ properties.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | < 7.5.6 >= 8.0.0, < 8.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |