Executive brief
protobuf.js is a widely-used JavaScript library for encoding and decoding Protocol Buffers, a serialization format commonly used in APIs and data storage. When the library dynamically generates encoding/decoding functions from a schema, certain control characters in field names can cause the generated code to have syntax errors, making those message types unusable. An attacker who can supply or influence a protobuf schema—such as in an application that loads schemas from untrusted sources—can exploit this to cause the application to crash or hang when attempting to use affected message types.
Technical details
protobuf.js generates JavaScript functions at runtime to encode, decode, verify, and convert protobuf messages based on a provided schema. The vulnerability stems from improper input validation (CWE-20) where control characters in field and oneof names are not escaped before being embedded into the dynamically generated function bodies. When a crafted schema containing such characters is processed, the generated code becomes syntactically invalid, causing a runtime error during code generation. The attack requires an application to load an untrusted schema or JSON descriptor and then invoke an operation like encode(), decode(), verify(), fromObject(), or toObject() on a message type with a malicious field name. The vulnerability affects all versions of protobufjs prior to 7.5.6 and 8.0.0–8.0.1; patches are available in versions 7.5.6 and 8.0.2.
Affected products
- protobufjs protobuf.js <= 7.5.5, >= 8.0.0 and <= 8.0.1
Timeline
- 2026-05-12: disclosed
- 2026-04-27: patched: Patches released in versions 7.5.6 and 8.0.2