protobufjs

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

protobufjs records in CISA KEV

No protobufjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Protobufjs 17 records HIGH Protobufjs-cli 4 records MEDIUM

Records

20 records

TI-2026-29851 CVE-2026-41242 · GHSA-xq3m-2v4x-88gg

protobufjs has an arbitrary code execution issue

HIGH 82

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00774 Published 2026-04-18 Partial fix · 7.5.5, 8.0.1 +1 CWE-94

TI-2023-18481 CVE-2023-36665 · GHSA-h755-8qp9-cq85

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution…

MEDIUM 45

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01697 Published 2023-07-05 Partial fix · 7.2.5, 6.11.4 CWE-1321

TI-2026-32266 CVE-2026-44295 · GHSA-6r35-46g8-jcw9

protobufjs-cli: Code injection in pbjs static output from crafted schema names

MEDIUM 40

protobufjs-cli is the command line add-on for protobuf.js.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00395 Published 2026-05-13 Fixed in 2.0.2, 1.2.1 CWE-94

TI-2026-32260 CVE-2026-44289 · GHSA-685m-2w69-288q

protobufjs: Denial of service through unbounded protobuf recursion

MEDIUM 40

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-674

TI-2022-09438 CVE-2022-25878 · GHSA-g954-5hwp-pp24

Prototype pollution in protobufjs

MEDIUM 40

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02329 Published 2022-05-27 Partial fix · 6.11.3, 6.10.3 CWE-1321

TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww

protobufjs: Denial of Service via infinite loop in .proto option parsing

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2026-07-08 Partial fix · 7.6.5, 8.6.6 CWE-835

TI-2026-35993 CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-06-22 Partial fix · 7.6.1, 8.4.1 CWE-674

TI-2026-32261 CVE-2026-44290 · GHSA-jvwf-75h9-cwgg

protobufjs: Process-wide denial of service through unsafe option paths

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00374 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-1321

TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

LOW 38

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00263 Published 2026-05-13 Partial fix · 7.5.8, 8.2.0 CWE-674

TI-2026-32262 CVE-2026-44291 · GHSA-75px-5xx7-5xc7

protobufjs: Code generation gadget after prototype pollution

LOW 38

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.005 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-94

TI-2026-39171 CVE-2026-54271 · GHSA-pr59-h9ph-3fr8

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

LOW 37

protobufjs-cli is the command line add-on for protobuf.js.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00303 Published 2026-06-22 Fixed in 1.3.2, 2.4.2 +1 CWE-94

TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm

protobufjs: Code injection through bytes field defaults in generated toObject code

LOW 36

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00407 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-94

TI-2026-30601 CVE-2026-42290 · GHSA-f84p-cvgm-xgjj

protobufjs-cli: OS Command Injection

LOW 35

protobufjs-cli is the command line add-on for protobuf.js.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00132 Published 2026-05-13 Fixed in 2.0.2, 1.2.1 CWE-78

TI-2026-39170 CVE-2026-54270 · GHSA-94rc-8x27-4472

protobufjs: Memory amplification from preserved unknown fields in binary decode

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00402 Published 2026-06-22 Partial fix · 8.5.0 CWE-770

TI-2026-39169 CVE-2026-54269 · GHSA-f38q-mgvj-vph7

protobufjs: Schema-derived names can shadow runtime-significant properties

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00402 Published 2026-06-22 Partial fix · 7.6.3, 8.6.0 +2 CWE-674

TI-2026-32265 CVE-2026-44294 · GHSA-2pr8-phx7-x9h3

protobufjs: Denial of service from crafted field names in generated code

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00431 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-20

TI-2026-32263 CVE-2026-44292 · GHSA-fx83-v9x8-x52w

protobufjs: Prototype injection in generated message constructors

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00264 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-1321

TI-2026-32259 CVE-2026-44288 · GHSA-q6x5-8v7m-xcrf

protobufjs: Overlong UTF-8 decoding

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00301 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 +1 CWE-176

TI-2018-02735 CVE-2018-3738 · GHSA-762f-c2wg-m8c8

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

LOW 27

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00943 Published 2018-06-07 Fixed in 6.8.6, 5.0.3 CWE-770

TI-2026-42690 CVE-2026-59876 · GHSA-jfj6-75fj-8934

protobufjs: Text Format string map parsing can mutate returned map object prototype

LOW 22

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00349 Published 2026-07-08 Partial fix · 8.6.5 CWE-1321

Open these records in search →

Critical	2
High	11
Medium	7
Low	0
No CVSS	0