CVE-2026-59876
CVE-2026-59876 · protobufjs: Text Format string map parsing can mutate returned map object prototype
This page contains facts from public vulnerability sources. Check the original advisory before updating.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
CVSS 4.8 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
protobuf.js
- Versions
- >= 8.2.0, < 8.6.5: Affected
No fix published
protobufjs npm
- Affected ranges
- SEMVER: ≥ 8.2.0, < 8.6.5
Update to 8.6.5
Original sources
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934
- https://github.com/protobufjs/protobuf.js/pull/2335
- https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5
- https://nvd.nist.gov/vuln/detail/CVE-2026-59876