protobuf.js: Code generation gadget after prototype pollution

Description

protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.0.1

  <= 7.5.5**

• Patched version(s): **8.0.2

  7.5.6**

References

• GHSA-75px-5xx7-5xc7
• CVE-2026-44291
• CWE-1321
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• protobuf.js: Code injection through bytes field defaults in generated toObject code - CVE-2026-44293
• protobuf.js: Prototype injection in generated message constructors - CVE-2026-44292
• Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
• protobuf.js: Denial of service from crafted field names in generated code - CVE-2026-44294

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs