Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-44288protobufjs: Overlong UTF-8 decoding
Medium 5.3
In plain English
A medium-severity security flaw in protobuf.js from protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @protobufjs/utf8 | 1.1.1 | GHSA-q6x5-8v7m-xcrf |
| npm | protobufjs | 7.5.6 | GHSA-q6x5-8v7m-xcrf |
| npm | protobufjs | 8.0.2 | GHSA-q6x5-8v7m-xcrf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| protobufjs | protobuf.js | < 7.5.6>= 8.0.0, < 8.0.2 |
Weakness: CWE-176 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N