Is CVE-2026-44290 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44290 being exploited in the wild.

How severe is CVE-2026-44290?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

protobufjs (npm) SEMVER:introduced=0,fixed=7.5.6.

Is there a fix for CVE-2026-44290?

Yes. protobufjs (npm): upgrade to 7.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44290 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44290?

Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44290: protobufjs prototype pollution in schema option handling

CVE-2026-44290 · Severity: high · CVSS 7.5 · Published 2026-05-13

protobufjs is a library used to handle Protocol Buffer data in JavaScript applications. A vulnerability exists where a specially crafted schema file can corrupt the internal state of the application. This can lead to a persistent service outage (denial of service) as the application's core functions become corrupted for the duration of the process.

Technologies: protobufjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-44290 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44290 being exploited in the wild.
How severe is CVE-2026-44290?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: protobufjs (npm) SEMVER:introduced=0,fixed=7.5.6.
Is there a fix for CVE-2026-44290?: Yes. protobufjs (npm): upgrade to 7.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44290 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44290?: Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

protobufjs (npm): upgrade to 7.5.6 or later
```
npm install protobufjs@7.5.6
```

Technical details

A prototype pollution vulnerability (CWE-1321) exists in protobufjs prior to versions 7.5.6 and 8.0.2. The library fails to properly sanitize schema option paths, allowing them to traverse through inherited object properties. An attacker who can provide a malicious protobuf schema or JSON descriptor can use these paths to write to properties on global JavaScript constructors. This corrupts built-in functionality, leading to a persistent denial of service. The vulnerability is exploitable via reflection APIs such as parse, Root.load, or Root.fromJSON when processing untrusted schemas.

Affected products

protobufjs protobufjs <=7.5.5, >=8.0.0, <=8.0.1

Identifiers

CVE-2026-44290
GHSA-jvwf-75h9-cwgg

Timeline

2026-05-12: advisory: GitHub Security Advisory published
2026-05-13: disclosed: NVD publication date

References

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.