Description
protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, <= 8.5.0 <= 7.6.2** Patched version(s): **8.6.0 7.6.3**
References
Could your website be exposed too?
SmartScanner can check your website for protobufjs : Schema-derived names can shadow runtime-significant properties and gives you actionable findings to investigate.
Start a free scanRelated Issues
- protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
- protobuf.js: Denial of service from crafted field names in generated code - CVE-2026-44294
- Valibot: record() issue paths can make flatten() throw for inherited Object property names - CVE-2026-59952
- Svelte SSR attribute spreading includes inherited properties from prototype chain - CVE-2026-27125
You might also like:
See something that needs correcting? Let us knowUpdated July 15, 2026