CVE-2026-59876
CVE-2026-59876 · protobufjs: Text Format string map parsing can mutate returned map object prototype
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
CVSS 4.8 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
protobuf.js
- Versiones
- >= 8.2.0, < 8.6.5: Afectada
Sin corrección publicada
protobufjs npm
- Intervalos de versiones afectados
- SEMVER: ≥ 8.2.0, < 8.6.5
Actualiza a 8.6.5
Fuentes originales
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934
- https://github.com/protobufjs/protobuf.js/pull/2335
- https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5
- https://nvd.nist.gov/vuln/detail/CVE-2026-59876