Description
protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
- Affected version(s): >= 8.2.0, <= 8.4.2
- Patched version(s): 8.5.0
References
Could your website be exposed too?
SmartScanner can check your website for protobufjs: Memory amplification from preserved unknown fields in binary decode and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
You might also like:
See something that needs correcting? Let us knowUpdated July 15, 2026