CVE-2026-44293: protobufjs code injection in toObject function generation

CVE-2026-44293 · Severity: high · CVSS 8.8 · Published 2026-05-13

protobufjs is a popular library used to handle data serialization in JavaScript applications. A security flaw allows an attacker to execute malicious code on a server if the application processes a specially crafted data schema from an untrusted source. This could lead to a full system compromise, unauthorized data access, or service disruption. Organizations should update to the latest versions of the library or affected Red Hat products immediately.

Technologies: protobufjs (npm), Protobufjs Protobuf.Js, Red Hat Developer Hub. Vendors: npm, Protobufjs, Red Hat.

Quick answers

Is CVE-2026-44293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44293 being exploited in the wild.
How severe is CVE-2026-44293?
High severity, with a CVSS score of 8.8, published 13 May 2026.
Which products and versions are affected?
protobufjs (npm) SEMVER:introduced=0,fixed=7.5.6; Protobufjs Protobuf.Js < 7.5.6, >= 8.0.0 < 8.0.2; Red Hat Developer Hub 1.9.
Is there a fix for CVE-2026-44293?
Yes. protobufjs (npm): upgrade to 7.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44293 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44293?
Check whether you run protobufjs (npm), Protobufjs Protobuf.Js or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • protobufjs (npm): upgrade to 7.5.6 or later
    npm install protobufjs@7.5.6

Technical details

A code injection vulnerability (CWE-94) exists in protobufjs due to improper sanitization of default values for 'bytes' fields during the generation of the 'toObject' conversion function. When the library compiles a protobuf descriptor into JavaScript, a non-string default value in a bytes field can cause the generator to emit unsafe expressions directly into the resulting function code. An attacker who can provide or influence a protobuf JSON descriptor or reflected schema can achieve arbitrary JavaScript execution in the context of the Node.js process. This exploit requires the application to load the malicious schema and call 'toObject' with defaults enabled. The issue is patched in versions 7.5.6 and 8.0.2.

Affected products

  • protobufjs protobuf.js < 7.5.6, >= 8.0.0 < 8.0.2
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 9

Identifiers

  • CVE-2026-44293
  • GHSA-66ff-xgx4-vchm

Timeline

  • 2026-05-12: advisory: GitHub Security Advisory published by maintainers
  • 2026-05-13: disclosed: NVD publication date
  • 2026-06-15: patched: Red Hat released security updates for OpenShift Service Mesh
  • 2026-06-16: patched: Red Hat released security updates for Developer Hub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.