Protobufjs
Approved changes feed: RSS · Atom
cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Protobufjs Project (651d57f6-c57d-5d8d-9053-8ea8f767ba40) |
|---|---|
| Product | Protobufjs (a161b990-b58d-5aa6-9249-e29ce55bc08a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/protobufjs/protobuf.js |
purl2cpe | 2026-06-01 10:16:07.772763 |
pkg:maven/org.webjars.npm/protobufjs |
purl2cpe | 2026-06-01 10:16:07.772764 |
pkg:npm/protobufjs |
purl2cpe | 2026-06-01 10:16:07.772766 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45740 |
vulnerable | 2026-06-08 08:05:11.853834 |
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
MEDIUM (5.3)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.
Published: 2026-05-13T14:46:02.689Z
Updated: 2026-05-13T18:20:12.394Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44294 |
vulnerable | 2026-06-08 08:05:10.539012 |
protobufjs: Denial of service from crafted field names in generated code
MEDIUM (5.3)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.
Published: 2026-05-13T14:44:30.474Z
Updated: 2026-05-13T18:34:31.882Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44293 |
vulnerable | 2026-06-08 08:05:10.538527 |
protobufjs: Code injection through bytes field defaults in generated toObject code
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
Published: 2026-05-13T14:43:33.342Z
Updated: 2026-09-09T12:05:01.307Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44292 |
vulnerable | 2026-06-08 08:05:10.537643 |
protobufjs: Prototype injection in generated message constructors
MEDIUM (5.3)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Published: 2026-05-13T14:42:55.155Z
Updated: 2026-05-18T14:01:31.297Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44291 |
vulnerable | 2026-06-08 08:05:10.536589 |
protobufjs: Code generation gadget after prototype pollution
HIGH (8.1)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
Published: 2026-05-13T14:42:13.984Z
Updated: 2026-05-13T15:32:06.425Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44290 |
vulnerable | 2026-06-08 08:03:18.230941 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44289 |
vulnerable | 2026-06-08 08:03:18.230558 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44288 |
vulnerable | 2026-06-08 08:03:18.230017 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41242 |
vulnerable | 2026-06-08 08:03:15.100909 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-36665 |
vulnerable | 2026-06-08 06:08:12.833303 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25878 |
vulnerable | 2026-06-08 05:41:49.613013 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3738 |
vulnerable | 2026-06-08 05:11:41.203830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.