CVE-2026-44290
CVE-2026-44290 · protobufjs: Process-wide denial of service through unsafe option paths
This page contains facts from public vulnerability sources. Check the original advisory before updating.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
protobuf.js
- Versions
- < 7.5.6: Affected
- >= 8.0.0, < 8.0.2: Affected
No fix published
protobufjs npm
- Affected ranges
- SEMVER: < 7.5.6
Update to 7.5.6
protobufjs npm
- Affected ranges
- SEMVER: ≥ 8.0.0, < 8.0.2
Update to 8.0.2