# CVE-2026-44294: protobufjs denial of service via crafted field names in generated code

Source: https://junglewise.ai/threats/cve-2026-44294-protobuf-js-denial-of-service-via-crafted-field-names  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44294 · Severity: medium · CVSS 5.3 · Published 2026-05-13

protobuf.js is a widely-used JavaScript library for encoding and decoding Protocol Buffers, a serialization format commonly used in APIs and data storage. When the library dynamically generates encoding/decoding functions from a schema, certain control characters in field names can cause the generated code to have syntax errors, making those message types unusable. An attacker who can supply or influence a protobuf schema—such as in an application that loads schemas from untrusted sources—can exploit this to cause the application to crash or hang when attempting to use affected message types.

Technologies: [Protobufjs Protobuf.Js](https://junglewise.ai/threats/technologies/protobuf-js). Vendors: [Protobufjs](https://junglewise.ai/threats/vendors/protobufjs).

## Quick answers

**Is CVE-2026-44294 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44294 being exploited in the wild.

**How severe is CVE-2026-44294?** Medium severity, with a CVSS score of 5.3, published 13 May 2026.

**Which products and versions are affected?** Protobufjs Protobuf.Js <= 7.5.5, >= 8.0.0 and <= 8.0.1.

**Is there a fix for CVE-2026-44294?** A patch was published on 2026-04-27: Patches released in versions 7.5.6 and 8.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44294 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44294?** Check whether you run Protobufjs Protobuf.Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

protobuf.js generates JavaScript functions at runtime to encode, decode, verify, and convert protobuf messages based on a provided schema. The vulnerability stems from improper input validation (CWE-20) where control characters in field and oneof names are not escaped before being embedded into the dynamically generated function bodies. When a crafted schema containing such characters is processed, the generated code becomes syntactically invalid, causing a runtime error during code generation. The attack requires an application to load an untrusted schema or JSON descriptor and then invoke an operation like encode(), decode(), verify(), fromObject(), or toObject() on a message type with a malicious field name. The vulnerability affects all versions of protobufjs prior to 7.5.6 and 8.0.0–8.0.1; patches are available in versions 7.5.6 and 8.0.2.

## Affected products

- protobufjs protobuf.js <= 7.5.5, >= 8.0.0 and <= 8.0.1

## Identifiers

- CVE-2026-44294
- GHSA-2pr8-phx7-x9h3

## Timeline

- 2026-05-12: disclosed
- 2026-04-27: patched: Patches released in versions 7.5.6 and 8.0.2

## References

- [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3)
- [https://github.com/protobufjs/protobuf.js](https://github.com/protobufjs/protobuf.js)
- [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6)
- [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2)

## Related threats

- [protobufjs code injection in toObject function generation](https://junglewise.ai/threats/cve-2026-44293-protobufjs-code-injection-in-toobject-function-generation)
- [protobufjs uncontrolled recursion in protobuf decoding](https://junglewise.ai/threats/cve-2026-44289-protobufjs-uncontrolled-recursion-in-protobuf-decoding)
- [protobufjs validation bypass via overlong UTF-8 sequences](https://junglewise.ai/threats/cve-2026-44288-protobufjs-validation-bypass-via-overlong-utf-8-sequences)