protobufjs: Memory amplification from preserved unknown fields in binary decode

Description

protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 8.2.0, <= 8.4.2
• Patched version(s): 8.5.0

References

• GHSA-94rc-8x27-4472
• CVE-2026-54270
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
• LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
• LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
• LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs