# CVE-2026-44290: protobufjs prototype pollution in schema option handling

Source: https://junglewise.ai/threats/cve-2026-44290-protobufjs-prototype-pollution-in-schema-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44290 · Severity: high · CVSS 7.5 · Published 2026-05-13

protobufjs is a library used to handle Protocol Buffer data in JavaScript applications. A vulnerability exists where a specially crafted schema file can corrupt the internal state of the application. This can lead to a persistent service outage (denial of service) as the application's core functions become corrupted for the duration of the process.

Technologies: [protobufjs (npm)](https://junglewise.ai/threats/technologies/protobufjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44290 being exploited in the wild.

**How severe is CVE-2026-44290?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** protobufjs (npm) SEMVER:introduced=0,fixed=7.5.6.

**Is there a fix for CVE-2026-44290?** Yes. protobufjs (npm): upgrade to 7.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44290 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44290?** Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- protobufjs (npm): upgrade to 7.5.6 or later

  ```sh
  npm install protobufjs@7.5.6
  ```


## Technical details

A prototype pollution vulnerability (CWE-1321) exists in protobufjs prior to versions 7.5.6 and 8.0.2. The library fails to properly sanitize schema option paths, allowing them to traverse through inherited object properties. An attacker who can provide a malicious protobuf schema or JSON descriptor can use these paths to write to properties on global JavaScript constructors. This corrupts built-in functionality, leading to a persistent denial of service. The vulnerability is exploitable via reflection APIs such as parse, Root.load, or Root.fromJSON when processing untrusted schemas.

## Affected products

- protobufjs protobufjs <=7.5.5, >=8.0.0, <=8.0.1

## Identifiers

- CVE-2026-44290
- GHSA-jvwf-75h9-cwgg

## Timeline

- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date

## References

- [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg)

## Related threats

- [protobufjs prototype mutation in Text Format string map parsing](https://junglewise.ai/threats/cve-2026-59876-protobufjs-prototype-pollution-in-text-format-extension)
- [protobufjs infinite loop in .proto option parsing](https://junglewise.ai/threats/cve-2026-59877-protobufjs-infinite-loop-in-proto-option-parsing)
- [protobufjs memory amplification via unknown field preservation](https://junglewise.ai/threats/cve-2026-54270-protobufjs-memory-amplification-via-unknown-field-preservation)
- [protobufjs property shadowing and uncontrolled recursion](https://junglewise.ai/threats/cve-2026-54269-protobufjs-property-shadowing-and-uncontrolled-recursion)
- [protobufjs uncontrolled recursion in JSON conversion](https://junglewise.ai/threats/cve-2026-48712-protobufjs-uncontrolled-recursion-in-json-conversion)