protobufjs has overlong UTF-8 decoding

Description

protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them.

The issue concerns overlong encodings and code points outside the Unicode range.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.0.1

  <= 7.5.5**

• Patched version(s): **8.0.2

  7.5.6**

References

• GHSA-q6x5-8v7m-xcrf
• CVE-2026-44288
• CWE-176
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs has overlong UTF-8 decoding - @protobufjs/utf8 - CVE-2026-44288
• Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664
• payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
• @tmlmobilidade/utils has prototype pollution in its setValueAtPath - CVE-2026-45325

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs