CVE-2026-59876 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
A vulnerability exists in the protobufjs library, specifically in versions 8.2.0 prior to 8.6.5, within the Text Format extension. This vulnerability allows string-keyed map entries to be parsed in a way that could unintentionally modify the prototype of the map object. When a map entry with the key '__proto__' is processed, it alters the prototype of the resulting map instead of simply adding a new entry. The issue has been addressed in version 8.6.5.
Users are advised to upgrade to protobufjs version 8.6.5 or later. If an immediate upgrade is not possible, avoid parsing untrusted protobuf Text Format input with versions affected by this vulnerability. Applications can also preemptively reject string map keys named '__proto__' before or during Text Format parsing.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8 | [email protected] | Patch |
| https://github.com/protobufjs/protobuf.js/pull/2335 | [email protected] | Issue TrackingPatch |
| https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5 | [email protected] | ProductRelease Notes |
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | >= 8.2.0, < 8.6.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |