protobufjs : Schema-derived names can shadow runtime-significant properties

Description

protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.5.0

  <= 7.6.2**

• Patched version(s): **8.6.0

  7.6.3**

References

• GHSA-f38q-mgvj-vph7
• CVE-2026-54269
• CWE-674
• CWE-754
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
• protobuf.js: Denial of service from crafted field names in generated code - CVE-2026-44294
• Valibot: record() issue paths can make flatten() throw for inherited Object property names - CVE-2026-59952
• Svelte SSR attribute spreading includes inherited properties from prototype chain - CVE-2026-27125

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs