Executive brief
A vulnerability in the protobufjs library, which is used to handle data serialization in JavaScript applications, could allow attackers to bypass security filters. By using specially crafted data sequences, an attacker can trick the system into accepting forbidden characters that were supposed to be blocked by initial security checks. This could lead to unauthorized data modification or the bypass of application-level security controls depending on how the decoded data is used.
Technical details
The vulnerability exists in the minimal UTF-8 decoder used by protobufjs in non-Node.js environments or fallback paths. The decoder incorrectly accepts overlong UTF-8 sequences and decodes them to canonical characters instead of rejecting them or using replacement characters. An attacker can exploit this by providing malicious protobuf binary data that bypasses raw byte-level inspections (e.g., filters looking for specific ASCII characters) because the forbidden characters only appear after the non-strict decoding process. This is classified as Improper Handling of Unicode Encoding (CWE-176). The issue is resolved in versions 7.5.6 and 8.0.2.
Affected products
- protobufjs protobufjs < 7.5.6, >= 8.0.0, < 8.0.2
- protobufjs @protobufjs/utf8 <= 1.1.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date