PT-2026-40537 · Npm · Protobufjs

Vladimirelitokarev · Published 2026-05-12 · Updated 2026-05-14 · CVE-2026-44291

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description protobufjs uses plain objects with inherited prototypes for internal type lookup tables within generated encode and decode functions. If Object.prototype is polluted, these lookup tables may resolve attacker-controlled inherited properties as valid protobuf type information, potentially causing attacker-controlled strings to be emitted into generated JavaScript code. This can lead to arbitrary JavaScript execution if an attacker can first trigger a prototype pollution vulnerability. Prototype pollution is a technique where an attacker manipulates the prototype of a base object to inject properties that are inherited by other objects.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Remove or mitigate reachable prototype pollution primitives and isolate schema or message processing from untrusted application state.

Fix

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2026-44291

GHSA-75PX-5XX7-5XC7

Affected Products

Protobufjs

References · 8

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44291 · Security Note
• https://osv.dev/vulnerability/GHSA-75px-5xx7-5xc7 · Vendor Advisory
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note
• https://t.me/cveNotify/163432 · Telegram Post
• https://t.me/CVEtracker/53655 · Telegram Post