Executive brief
protobufjs is a library used to handle Protocol Buffer data in JavaScript applications. A vulnerability exists where a specially crafted schema file can corrupt the internal state of the application. This can lead to a persistent service outage (denial of service) as the application's core functions become corrupted for the duration of the process.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in protobufjs prior to versions 7.5.6 and 8.0.2. The library fails to properly sanitize schema option paths, allowing them to traverse through inherited object properties. An attacker who can provide a malicious protobuf schema or JSON descriptor can use these paths to write to properties on global JavaScript constructors. This corrupts built-in functionality, leading to a persistent denial of service. The vulnerability is exploitable via reflection APIs such as parse, Root.load, or Root.fromJSON when processing untrusted schemas.
Affected products
- protobufjs protobufjs <=7.5.5, >=8.0.0, <=8.0.1
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date