Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-44292protobufjs: Prototype injection in generated message constructors
Medium 5.3
In plain English
A medium-severity prototype pollution in protobuf.js from protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | protobufjs | 7.5.6 | GHSA-fx83-v9x8-x52w |
| npm | protobufjs | 8.0.2 | GHSA-fx83-v9x8-x52w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| protobufjs | protobuf.js | < 7.5.6>= 8.0.0, < 8.0.2 |
Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N