protobufjs has overlong UTF-8 decoding - @protobufjs/utf8

Description

protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them.

The issue concerns overlong encodings and code points outside the Unicode range.

Recommendation

Update the @protobufjs/utf8 package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.0
• Patched version(s): 1.1.1

References

• GHSA-q6x5-8v7m-xcrf
• CVE-2026-44288
• CWE-176
• CAPEC-310
• OWASP 2021-A6