CVE-2026-54269 Details

A denial-of-service vulnerability has been identified in protobufjs versions 8.0.0 through 8.5.0 and 7.6.2 and prior. The issue arises because protobufjs accepts certain schema-derived names that can collide with properties used by its runtime helpers. Affected names include fields named 'hasOwnProperty', field or oneof names such as '$type' when loaded through protobufjs JSON or reflection descriptors, and service methods with the generated helper name 'rpcCall'. When these names are used, protobufjs may read schema-controlled data where it expects an own-property helper, reflected type metadata, or the base RPC helper. This can lead to deterministic exceptions or recursive calls in various processing paths, such as decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation.

To address this vulnerability, do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources with affected versions. If untrusted schemas or descriptors must be accepted, validate the names derived from the schema before loading and reject any that include the problematic names. Applications using trusted schemas can avoid the issue by renaming affected fields or service methods, or by steering clear of the impacted API paths.