protobufjs has overlong UTF-8 decoding - @protobufjs/utf8

Description

protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them.

The issue concerns overlong encodings and code points outside the Unicode range.

Recommendation

Update the @protobufjs/utf8 package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.0
• Patched version(s): 1.1.1

References

• GHSA-q6x5-8v7m-xcrf
• CVE-2026-44288
• CWE-176
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs has overlong UTF-8 decoding - CVE-2026-44288
• Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664
• payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
• @tmlmobilidade/utils has prototype pollution in its setValueAtPath - CVE-2026-45325

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@protobufjs/utf8