CVE-2026-59876: protobufjs Text Format Prototype Pollution Vulnerability

Technical summary

The vulnerability exists in protobufjs/ext/textformat where string-keyed map entries are processed. The affected code path uses direct property assignment (e.g., `mapObject[key] = value`) without distinguishing between regular properties and prototype-related keys. When a map entry contains the key `__proto__`, the assignment operates on the object's prototype rather than creating a map entry, causing prototype pollution. This affects versions 8.2.0 through 8.6.4. The issue is rooted in CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes in JavaScript). The fix in 8.6.5 implements safer property assignment mechanisms that prevent prototype pollution, likely through use of Object.defineProperty, Map data structures, or explicit property checks.

Business impact

Applications using protobufjs to parse user-controlled or untrusted protobuf text formats are at risk. An attacker could potentially modify object prototypes to inject malicious properties or methods that affect downstream logic, leading to information disclosure or logic bypass. In supply chain scenarios where protobuf definitions are fetched or updated from external sources, this could be leveraged for unauthorized behavior. The impact is limited to integrity and confidentiality; availability is not directly affected. Organizations relying on protobufjs for API communication, configuration parsing, or message handling should assess their exposure based on whether untrusted text-format input is processed.

Affected systems

protobufjs versions 8.2.0 through 8.6.4 are affected. The vulnerability specifically impacts code paths that use the Text Format extension to parse protobuf messages in human-readable text form. Not all applications using protobufjs are affected—only those that (1) use the textformat extension and (2) process text-format protobufs from untrusted sources. Applications exclusively using binary format parsing or trusted input are unaffected.

Exploitability

The CVSS score of 4.8 (MEDIUM) reflects moderate exploitability. While the attack requires network access and no privileged user interaction, it demands higher complexity: an attacker must control or influence protobuf text input and have knowledge of the application's object structure to craft a meaningful attack. This is not a simple worm vector. Exploitation is feasible in scenarios where applications accept user-submitted protobuf messages in text format or dynamically load protobuf definitions. However, it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active exploitation in the wild has been reported or confirmed at the time of publication.

Remediation

Upgrade protobufjs to version 8.6.5 or later immediately. If an immediate upgrade is not feasible, implement input validation to reject or sanitize protobuf text format that contains suspicious keys like `__proto__`, `constructor`, or `prototype`. Limit the sources from which protobuf definitions and text-format messages are accepted, and use binary format (rather than text format) where possible. Code review should verify that the textformat extension is not being used with untrusted input.

Patch guidance

Update protobufjs from any version in the 8.2.0–8.6.4 range to 8.6.5. Check your package.json or package-lock.json for the currently installed version. If you are on version 8.6.5 or later, no action is required. If you are on 8.2.0 or later but before 8.6.5, apply the patch during your next maintenance window. Verify the update by checking that `require('protobufjs/package.json').version` shows 8.6.5 or higher. Test that text-format protobuf parsing continues to work as expected after the update.

Detection guidance

Monitor for attempts to parse protobuf text messages containing keys such as `__proto__`, `constructor`, or `prototype`. Log all text-format parsing operations and flag messages with suspicious key names. If you have runtime instrumentation, watch for unexpected modifications to Object.prototype or other core prototypes. Review application logs for error conditions or unexpected behavior correlating with protobuf message parsing. Additionally, monitor your supply chain for updates to protobufjs and ensure you have alerting configured for security advisories related to this library.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized based on your application's specific use of protobufjs. If your application processes untrusted protobuf text input, prioritize the upgrade to 8.6.5 within the next 30 days. If you use only binary format or parse only internal/trusted protobuf sources, the urgency is lower. The absence from the KEV catalog suggests limited real-world exploitation, but prototype pollution vulnerabilities are well-understood by adversaries and can enable downstream attacks.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects: Network-accessible attack vector with high complexity requirements (knowledge of input format and object structure needed); no authentication required; impacts both confidentiality and integrity of the targeted object's data, but does not compromise availability or escalate privileges. The score is moderate rather than high because the vulnerability requires attacker control over text-format input and careful crafting of malicious keys, making opportunistic exploitation less likely than with simpler vulnerabilities.

Frequently asked questions