CVE-2026-54269: protobufjs Name Collision Denial of Service Vulnerability

Technical summary

The vulnerability stems from insufficient name-space isolation in protobufjs's runtime helper generation. The library compiles protobuf descriptors into JavaScript objects, but does not adequately protect against collision with schema-derived field names. Specifically: (1) message fields named 'hasOwnProperty' can shadow the Object prototype method; (2) field or oneof names like '$type' can collide with protobufjs's own type metadata property; (3) service method names that generate a helper named 'rpcCall' can collide with the RPC invocation utility. These collisions cause the runtime to read schema data where it expects internal helper functions or metadata, leading to type confusion or incorrect control flow. The affected code paths include message decoding post-checks, field verification, object conversion, reflected JSON serialization, and RPC helper dispatch—all of which can trigger exceptions or unbounded recursion when helpers are replaced by schema-controlled values.

Business impact

Applications using protobufjs to parse untrusted or attacker-supplied Protocol Buffer schemas face denial-of-service risk. An attacker who can influence or inject a malicious schema definition (whether through a man-in-the-middle attack, compromise of a schema repository, or direct protocol manipulation) can cause the application to crash or hang, disrupting availability. This is particularly concerning for microservices architectures or API gateways that dynamically load schemas, where a single malicious schema could affect many downstream consumers. The impact is limited to availability; no confidentiality or integrity breach is possible.

Affected systems

All applications using protobufjs versions prior to 8.6.0 (8.x branch) or prior to 7.6.3 (7.x branch) are affected. This includes direct use of the protobufjs library and indirect use through the protobufjs-cli tool for code generation. Any system that loads or processes Protocol Buffer schemas from untrusted sources, or that exposes schema loading to user input, is at risk. Organizations using older LTS or pinned versions should verify their exact version and update accordingly.

Exploitability

The vulnerability requires that an attacker can supply or influence a Protocol Buffer schema that will be compiled and used by the affected application. Exploitability depends on the threat model: if schemas are hardcoded and immutable, risk is minimal; if schemas are loaded from external sources, configuration files, or user input, exploitability is high. No authentication or user interaction is required to trigger the flaw once a malicious schema is loaded. The attack is deterministic—specific schema field names will reliably cause the condition. However, the vulnerability has not been added to the CISA KEV catalog, suggesting either limited real-world exploitation or recent discovery.

Remediation

Update protobufjs to version 8.6.0 or later (8.x series) or version 7.6.3 or later (7.x series). Review all code paths that load Protocol Buffer schemas to ensure they validate schema sources and reject schemas from untrusted origins. If schemas must be loaded dynamically, implement schema whitelisting or cryptographic verification. Audit existing schemas for use of the problematic names (hasOwnProperty, $type, rpcCall) and rename fields if found. Consider pinning or strictly version-controlling schema definitions to prevent injection.

Patch guidance

The vendor has released fixes in the 8.6.0 and 7.6.3 releases. Users on the 8.x branch should update to 8.6.0 or later; users on the 7.x branch should update to 7.6.3 or later. Both patches address the name-collision issue by ensuring that internal helpers and metadata properties cannot be shadowed by schema-derived names. Verify the patch version in your package lock file or dependency manager output. If you maintain custom builds or forks of protobufjs, backport the relevant fixes or upgrade to the patched version. Test thoroughly in a staging environment, particularly with any custom or legacy schemas, before deploying to production.

Detection guidance

Monitor for unexpected exceptions or hangs in protobufjs message decoding or RPC dispatch, especially if schemas were recently added or modified. Log schema loading events and their sources; alert if schemas are loaded from unexpected locations. Use static analysis tools to scan .proto files for field names that match the problematic set (hasOwnProperty, $type, rpcCall). In running applications, watch for crashes with stack traces pointing to protobufjs decode, verify, or RPC helper functions. If possible, enable debug logging in protobufjs to trace which schema names are being compiled.

Why prioritize this

Although the CVSS score is moderate (5.3, MEDIUM severity) and limited to denial of service, the vulnerability should be prioritized based on your attack surface. If your organization loads schemas from external sources or user-controlled locations, patch immediately. If schemas are entirely static and vendor-controlled, the risk is lower but still warrants timely patching as a precaution. The fix is straightforward (version bump) and has been available since mid-2026, so delay increases exposure unnecessarily.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability (AV:N) with low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact is limited to availability (A:L; no confidentiality or integrity impact), resulting in a MEDIUM severity rating. The scope is unchanged (S:U), meaning the impact is confined to the affected component. The score does not account for the attacker's need to inject or influence a schema, which in some contexts may raise or lower practical risk.

Frequently asked questions