Description
protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, <= 8.0.1 <= 7.5.5** Patched version(s): **8.0.2 7.5.6**
References
Could your website be exposed too?
SmartScanner can check your website for protobuf.js: Code generation gadget after prototype pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion - CVE-2026-42042
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` - CVE-2026-44494
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026