Description
protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, <= 8.0.1 <= 7.5.5** Patched version(s): **8.0.2 7.5.6**
References
Could your website be exposed too?
SmartScanner can check your website for protobuf.js: Process-wide denial of service through unsafe option paths and gives you actionable findings to investigate.
Start a free scanRelated Issues
- protobuf.js: Denial of service through unbounded protobuf recursion - CVE-2026-44289
- protobufjs: Denial of Service via infinite loop in .proto option parsing - CVE-2026-59877
- protobufjs: Denial of service through unbounded Any expansion during JSON conversion - CVE-2026-48712
- protobuf.js: Denial of service from crafted field names in generated code - CVE-2026-44294
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026