protobufjs has overlong UTF-8 decoding - @protobufjs/utf8

Description

protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them.

The issue concerns overlong encodings and code points outside the Unicode range.

Recommendation

Update the @protobufjs/utf8 package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.0
• Patched version(s): 1.1.1

References

• GHSA-q6x5-8v7m-xcrf
• CVE-2026-44288
• CWE-176
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs has overlong UTF-8 decoding - CVE-2026-44288
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• music-metadata has an infinite loop vulnerability in ASF parser - CVE-2026-32256
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@protobufjs/utf8