Executive brief
protobufjs is a library used to handle data serialization in JavaScript applications. A vulnerability in how it creates new data objects allows an attacker to manipulate the internal structure of those objects if they can provide the input data (such as through a malicious JSON file). While this does not affect the entire system, it can lead to unexpected behavior, data integrity issues, or security bypasses depending on how the application uses those specific objects.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in protobufjs due to improper filtering of the '__proto__' key during object construction. When the library generates message constructors, it copies enumerable properties from a provided object without validation. An attacker who can influence the properties object (e.g., via parsed JSON) can inject a '__proto__' property to alter the prototype of that specific message instance. This is a per-instance injection and does not affect the global Object.prototype. The vulnerability is reachable over the network if the application processes untrusted input to create protobuf messages. It has been patched in versions 7.5.6 and 8.0.2.
Affected products
- protobufjs project protobufjs < 7.5.6, >= 8.0.0 < 8.0.2
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date