By vendor

Protobufjs_project vulnerabilities

Known CVEs affecting Protobufjs_project products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-54271HIGH 8.2

  protobufjs-cli, a command-line tool for generating JavaScript code from Protocol Buffer schemas, contains a code injection vulnerability that allows attackers to embed malicious code into generated JavaScript files. The flaw is a bypass of an earlier partial fix (CVE-2026-44295) that failed to fully sanitize unsafe names when processing JSON-formatted schema descriptors. If an attacker can supply or modify the JSON input fed to the pbjs static code generator, they can inject code that executes when the generated file is imported or used. The vulnerability does not affect the common workflow of parsing .proto files directly. Versions prior to 1.3.2 and 2.5.0 are vulnerable.

• CVE-2026-48712HIGH 7.5

  protobufjs is a widely used JavaScript library that converts protobuf message definitions into executable code. Versions before 7.6.1 and 8.4.1 contain a flaw where the library fails to limit recursion depth when converting decoded protobuf messages to plain JavaScript objects or JSON format. An attacker can craft a malicious protobuf message with deeply nested structures (particularly using the google.protobuf.Any type) that will cause the JavaScript runtime to exhaust its call stack, crashing the application. This is a denial-of-service vulnerability affecting any service that parses untrusted protobuf input and converts it to JSON or object form.

• CVE-2026-54269MEDIUM 5.3

  protobufjs is a widely-used library that converts Protocol Buffer schema definitions into JavaScript code. Versions before 8.6.0 and 7.6.3 contain a flaw where certain field or service names—particularly hasOwnProperty, $type, and rpcCall—can collide with names reserved by protobufjs's internal runtime helpers. When a schema uses these conflicting names, the library may read attacker-controlled data from the schema instead of accessing its own safety mechanisms, potentially causing the application to crash or enter infinite loops during message decoding, validation, or RPC operations.

• CVE-2026-54270MEDIUM 5.3

  protobufjs, a popular JavaScript library for working with Protocol Buffers, has a memory exhaustion vulnerability in versions 8.2.0 through 8.4.2. When decoding untrusted protobuf messages, the library automatically stores unknown fields in memory without providing a way to discard them at decode time. An attacker can craft a malicious protobuf payload with many unknown fields that forces the decoded message to consume far more memory than the payload's raw size would suggest, potentially causing denial of service through resource exhaustion. The vulnerability affects applications that decode protobuf data from untrusted sources, particularly those handling user-supplied or network-sourced messages. Version 8.5.0 introduced options to control unknown-field retention, and version 8.6.2 made discarding unknown fields the default behavior.