Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-44291protobufjs: Code generation gadget after prototype pollution
High 8.1
In plain English
A high-severity code injection in protobuf.js from protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | protobufjs | 7.5.6 | GHSA-75px-5xx7-5xc7 |
| npm | protobufjs | 8.0.2 | GHSA-75px-5xx7-5xc7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| protobufjs | protobuf.js | < 7.5.6>= 8.0.0, < 8.0.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H