{"kind": "product", "path": "vulns/npm/protobufjs", "name": "protobufjs", "product": "protobufjs", "ecosystem": "npm", "items": [{"id": "CVE-2026-59876", "noindex": false, "published": "2026-07-08T15:31:11.421Z", "modified": "2026-07-09T14:41:45.107Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-59876", "title": "protobufjs: Text Format string map parsing can mutate returned map object prototype", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934", "https://github.com/protobufjs/protobuf.js/pull/2335", "https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8"], "fixes": ["8.6.5"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-59877", "noindex": false, "published": "2026-07-08T15:28:07.696Z", "modified": "2026-07-08T15:49:27.814Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00365, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-59877", "title": "protobufjs: Denial of Service via infinite loop in .proto option parsing", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww", "https://github.com/protobufjs/protobuf.js/pull/2352", "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"], "fixes": ["7.6.5", "8.6.6"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-54269", "noindex": false, "published": "2026-06-22T16:23:24.383Z", "modified": "2026-06-23T16:09:36.165Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00402, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54269", "title": "protobufjs: Schema-derived names can shadow runtime-significant properties", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic e", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7", "https://nvd.nist.gov/vuln/detail/CVE-2026-54269"], "fixes": ["7.6.3", "8.6.0"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-48712", "noindex": false, "published": "2026-06-22T16:21:21.506Z", "modified": "2026-06-23T15:54:24.472Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-48712", "title": "protobufjs: Denial of service through unbounded Any expansion during JSON conversion", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6", "https://nvd.nist.gov/vuln/detail/CVE-2026-48712"], "fixes": ["7.6.1", "8.4.1"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-54270", "noindex": false, "published": "2026-06-22T16:19:20.449Z", "modified": "2026-06-23T16:09:51.638Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00402, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54270", "title": "protobufjs: Memory amplification from preserved unknown fields in binary decode", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-94rc-8x27-4472", "https://nvd.nist.gov/vuln/detail/CVE-2026-54270"], "fixes": ["8.5.0"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-45740", "noindex": false, "published": "2026-05-13T14:46:02.689Z", "modified": "2026-05-13T18:20:12.394Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00263, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-45740", "title": "protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6", "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"], "fixes": ["7.5.8", "8.2.0"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44294", "noindex": false, "published": "2026-05-13T14:44:30.474Z", "modified": "2026-05-13T18:34:31.882Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00431, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44294", "title": "protobufjs: Denial of service from crafted field names in generated code", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3", "https://nvd.nist.gov/vuln/detail/CVE-2026-44294"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44293", "noindex": false, "published": "2026-05-13T14:43:33.342Z", "modified": "2026-09-09T12:05:01.307Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00407, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44293", "title": "protobufjs: Code injection through bytes field defaults in generated toObject code", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm", "https://access.redhat.com/security/cve/CVE-2026-44293", "https://bugzilla.redhat.com/show_bug.cgi?id=2477104"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44292", "noindex": false, "published": "2026-05-13T14:42:55.155Z", "modified": "2026-05-18T14:01:31.297Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00264, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44292", "title": "protobufjs: Prototype injection in generated message constructors", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w", "https://nvd.nist.gov/vuln/detail/CVE-2026-44292"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44291", "noindex": false, "published": "2026-05-13T14:42:13.984Z", "modified": "2026-05-13T15:32:06.425Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.005, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44291", "title": "protobufjs: Code generation gadget after prototype pollution", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7", "https://nvd.nist.gov/vuln/detail/CVE-2026-44291"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44290", "noindex": false, "published": "2026-05-13T14:41:15.312Z", "modified": "2026-05-14T13:45:12.701Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00374, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44290", "title": "protobufjs: Process-wide denial of service through unsafe option paths", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg", "https://nvd.nist.gov/vuln/detail/CVE-2026-44290"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44289", "noindex": false, "published": "2026-05-13T14:39:09.791Z", "modified": "2026-08-28T12:04:26.986Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0063, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44289", "title": "protobufjs: Denial of service through unbounded protobuf recursion", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q", "https://access.redhat.com/security/cve/CVE-2026-44289", "https://bugzilla.redhat.com/show_bug.cgi?id=2477130"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-44288", "noindex": false, "published": "2026-05-13T14:37:26.624Z", "modified": "2026-05-13T18:33:51.296Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00301, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44288", "title": "protobufjs: Overlong UTF-8 decoding", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf", "https://nvd.nist.gov/vuln/detail/CVE-2026-44288"], "fixes": ["7.5.6", "8.0.2"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-41242", "noindex": false, "published": "2026-04-18T16:18:10.652Z", "modified": "2026-09-09T12:05:00.268Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00774, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41242", "title": "protobufjs has an arbitrary code execution issue", "description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.", "references": ["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg", "https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75", "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956"], "fixes": ["7.5.5", "8.0.1"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2023-36665", "noindex": false, "published": "2023-07-05T00:00:00.000Z", "modified": "2024-08-02T16:52:54.371Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.01697, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-36665", "title": "CVE-2023-36665", "description": "\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.", "references": ["https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4", "https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d", "https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665"], "fixes": ["6.11.4", "7.2.5"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2022-25878", "noindex": false, "published": "2022-05-27T20:00:15.716Z", "modified": "2024-09-17T02:36:03.191Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P", "severity": "high", "epss": 0.02329, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-25878", "title": "Prototype Pollution", "description": "The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files", "references": ["https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248", "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507", "https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197"], "fixes": ["6.10.3", "6.11.3"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}, {"id": "CVE-2018-3738", "noindex": false, "published": "2018-06-07T02:00:00.000Z", "modified": "2024-09-16T23:46:56.890Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00943, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2018-3738", "title": "CVE-2018-3738", "description": "protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.", "references": ["https://hackerone.com/reports/319576", "https://nvd.nist.gov/vuln/detail/CVE-2018-3738"], "fixes": ["5.0.3", "6.8.6"], "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}, {"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}]}], "total": 17, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "protobufjs", "path": "vulns/npm/protobufjs", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-09T12:05:01.307Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}