Vulnerability Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Protobufjs Project | Protobufjs | < 7.5.6 |
Related Weaknesses (CWE)
References
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xcMitigationVendor Advisory
FAQ
What is CVE-2026-44291?
CVE-2026-44291 is a vulnerability with a CVSS score of 8.1 (HIGH). protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by gener...
How severe is CVE-2026-44291?
CVE-2026-44291 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44291?
Check the references section above for vendor advisories and patch information. Affected products include: Protobufjs Project Protobufjs.