PT-2026-40538 · Npm · Protobufjs

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44292

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description Message constructors generate JavaScript functions that copy enumerable properties from a provided properties object without filtering the proto key. If an application constructs a message from an attacker-controlled plain object, an own enumerable proto property can alter the prototype of that individual message instance. This per-instance prototype injection allows an attacker to modify the prototype chain of the resulting message instance, which may impact downstream application behavior relying on inherited properties, prototype methods, or instanceof checks. Applications that only decode binary protobuf data or use trusted objects are not affected.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Validate or sanitize object keys to reject proto properties when accepting untrusted JSON input before constructing messages. Avoid passing attacker-controlled plain objects directly to generated message constructors.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-44292

GHSA-FX83-V9X8-X52W

Affected Products

Protobufjs

References · 7

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fx83-v9x8-x52w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44292 · Security Note
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://t.me/CVEtracker/53656 · Telegram Post