TI-2026-29851 CVE-2026-41242 · GHSA-xq3m-2v4x-88gg
protobufjs has an arbitrary code execution issue
Priority HIGH 82
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
protobufjs
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
protobufjs records in CISA KEVNo protobufjs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records in Protobufjs · all components
TI-2023-18481 CVE-2023-36665 · GHSA-h755-8qp9-cq85
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution…
Priority MEDIUM 45
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.
TI-2026-32260 CVE-2026-44289 · GHSA-685m-2w69-288q
protobufjs: Denial of service through unbounded protobuf recursion
Priority MEDIUM 40
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2022-09438 CVE-2022-25878 · GHSA-g954-5hwp-pp24
Prototype pollution in protobufjs
Priority MEDIUM 40
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.
TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww
protobufjs: Denial of Service via infinite loop in .proto option parsing
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-35993 CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32261 CVE-2026-44290 · GHSA-jvwf-75h9-cwgg
protobufjs: Process-wide denial of service through unsafe option paths
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Priority LOW 38
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32262 CVE-2026-44291 · GHSA-75px-5xx7-5xc7
protobufjs: Code generation gadget after prototype pollution
Priority LOW 38
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm
protobufjs: Code injection through bytes field defaults in generated toObject code
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-39170 CVE-2026-54270 · GHSA-94rc-8x27-4472
protobufjs: Memory amplification from preserved unknown fields in binary decode
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-39169 CVE-2026-54269 · GHSA-f38q-mgvj-vph7
protobufjs: Schema-derived names can shadow runtime-significant properties
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32265 CVE-2026-44294 · GHSA-2pr8-phx7-x9h3
protobufjs: Denial of service from crafted field names in generated code
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32263 CVE-2026-44292 · GHSA-fx83-v9x8-x52w
protobufjs: Prototype injection in generated message constructors
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32259 CVE-2026-44288 · GHSA-q6x5-8v7m-xcrf
protobufjs: Overlong UTF-8 decoding
Priority LOW 30
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2018-02735 CVE-2018-3738 · GHSA-762f-c2wg-m8c8
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Priority LOW 27
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
TI-2026-42690 CVE-2026-59876 · GHSA-jfj6-75fj-8934
protobufjs: Text Format string map parsing can mutate returned map object prototype
Priority LOW 22
protobufjs compiles protobuf definitions into JavaScript (JS) functions.