Skip to content
OpenAdvisories

Package · npm

protobufjs

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-41242 Public exploit

    protobufjs has an arbitrary code execution issue

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  • Critical 9.8
    CVE-2023-36665

    protobufjs Prototype Pollution vulnerability

    "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and o…

    protobufjs npm