Skip to content
OpenAdvisories

Package · npm

protobufjs

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-48712

    protobufjs: Denial of service through unbounded Any expansion during JSON conversion

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the…

    protobufjs protobuf.js langfuse-3-worker langfuse-3 Wolfi npm
  • High 7.7
    CVE-2026-44293

    protobufjs: Code injection through bytes field defaults in generated toObject code

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 8.1
    CVE-2026-44291

    protobufjs: Code generation gadget after prototype pollution

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had a…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 7.5
    CVE-2026-44290

    protobufjs: Process-wide denial of service through unsafe option paths

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descrip…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 7.5
    CVE-2026-44289

    protobufjs: Denial of service through unbounded protobuf recursion

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of n…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 8.2
    CVE-2022-25878

    Prototype Pollution

    The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or…

    protobufjs npm