PT-2026-40534 · Npm · Protobufjs

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44288

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths that accepts overlong UTF-8 byte sequences—sequences that use more bytes than necessary to represent a character—and decodes them to their canonical characters instead of replacing them. An attacker providing protobuf binary data decoded through this path may bypass application-level checks that inspect raw bytes before string decoding. For instance, bytes not containing specific ASCII characters could decode into strings that do contain them. The impact depends on how the downstream application validates and uses the decoded strings.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Avoid relying solely on byte-level filtering before protobuf string decoding. Validate decoded strings at the point of use. Prefer runtime paths that utilize native UTF-8 decoding.

Fix

Weakness Enumeration

CWE-176

Related Identifiers

CVE-2026-44288

GHSA-Q6X5-8V7M-XCRF

Affected Products

Protobufjs

References · 6

• https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44288 · Security Note
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf · Note
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note