CVE-2026-54270 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.
A memory amplification vulnerability has been identified in protobufjs versions 8.2.0 prior to 8.4.2. This issue arises because the library preserved unknown wire elements during binary decoding, storing them in 'message.$unknowns', without offering an option to discard these fields before retention. As a result, a crafted protobuf payload with numerous unknown fields could cause a decoded message to consume significantly more memory than the original payload size would indicate. This vulnerability can degrade application performance or lead to process termination in services that handle and retain the modified messages.
Users can upgrade to protobufjs version 8.5.0 or later and disable unknown-field preservation if it is not needed. This can be done by creating a 'Reader', setting 'reader.discardUnknown' to true, and decoding from that reader. Alternatively, when upgrading to protobufjs version 8.6.2 or newer, unknown fields are discarded by default unless explicitly opted into. Applications should also continue to enforce input-size, request concurrency, and request timeout limits at their transport or application boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-94rc-8x27-4472 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | >= 8.2.0, < 8.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |