protobufjs protobuf.js
16 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59876 | >= 8.2.0, < 8.6.5 | protobufjs: Text Format string map parsing can mutate returned map object prototype | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-59877 | >= 7.5.0, < 7.6.5 ; >= 8.0.0, < 8.6.6 | protobufjs: Denial of Service via infinite loop in .proto option parsing | HIGH 7.5 | 0.4 % | ||
| CVE-2026-54269 | < 7.6.3 ; >= 8.0.0, < 8.6.0 | protobufjs: Schema-derived names can shadow runtime-significant properties | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-48712 | < 7.6.1 ; >= 8.0.0, < 8.4.1 | protobufjs: Denial of service through unbounded Any expansion during JSON conversion | HIGH 7.5 | 0.5 % | ||
| CVE-2026-54270 | >=8.2.0, < 8.5.0 | protobufjs: Memory amplification from preserved unknown fields in binary decode | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-44295 | >= 2.0.0, < 2.0.2 ; < 1.2.1 | protobufjs-cli: Code injection in pbjs static output from crafted schema names | HIGH 8.7 | 0.4 % | ||
| CVE-2026-42290 | >= 2.0.0, < 2.0.2 ; < 1.2.1 | protobufjs-cli: OS Command Injection | HIGH 7.8 | 0.1 % | ||
| CVE-2026-45740 | < 7.5.8 ; >= 8.0.0, < 8.2.0 | protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion | HIGH 7.5 | 0.3 % | ||
| CVE-2026-44294 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Denial of service from crafted field names in generated code | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-44293 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Code injection through bytes field defaults in generated toObject code | HIGH 7.7 | 0.4 % | ||
| CVE-2026-44292 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Prototype injection in generated message constructors | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-44291 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Code generation gadget after prototype pollution | HIGH 8.1 | 0.5 % | ||
| CVE-2026-44290 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Process-wide denial of service through unsafe option paths | HIGH 7.5 | 0.4 % | ||
| CVE-2026-44289 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Denial of service through unbounded protobuf recursion | HIGH 7.5 | 0.6 % | ||
| CVE-2026-44288 | < 7.5.6 ; >= 8.0.0, < 8.0.2 | protobufjs: Overlong UTF-8 decoding | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-41242 | < 7.5.5 ; >= 8.0.0-experimental, < 8.0.1 | protobufjs has an arbitrary code execution issue | CRITICAL 9.4 | 0.8 % |