Skip to main content
cve.nowby Sazabi
← npm
npmPackage

protobufjs

17 known vulnerabilities (1 critical, 6 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
8.8.1 (Oct 11, 2026): no advisory affects it
Newest unaffected release
8.8.1 (Oct 11, 2026), the latest release
Advisories
17 · 1 critical, 6 high, 8 medium
Weekly downloads
123.6M
Dependents
2,838
Releases
221 since 0.0.0 (Mar 1, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59876
    Affects 8.2.0 to 8.6.4 (8.6.5 is outside it)
  • CVE-2026-59877
    Affects 7.5.0 to 7.6.4 (7.6.5 is outside it); 8.0.0 to 8.6.5 (8.6.6 is outside it)
  • CVE-2026-54269
    Affects 0.0.0 to 7.6.2 (7.6.3 is outside it); 8.0.0 to 8.5.0 (8.6.0 is outside it)
  • CVE-2026-48712
    Affects 0.0.0 to 7.6.0 (7.6.1 is outside it); 8.0.0 to 8.4.0 (8.4.1 is outside it)
  • CVE-2026-54270
    Affects 8.2.0 to 8.4.2 (8.5.0 is outside it)
  • CVE-2026-45740
    Affects 0.0.0 to 7.5.7 (7.5.8 is outside it); 8.0.0 to 8.1.6-experimental (8.2.0 is outside it)
  • CVE-2026-44294
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-44293
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-44292
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-44291
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-44290
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-44289
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
Show all 17 advisoriesShow fewer advisories
  • CVE-2026-44288
    Affects 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
  • CVE-2026-41242
    Affects 0.0.0 to 6.11.5 (6.11.6 is outside it); 7.0.0 to 7.5.4 (7.5.5 is outside it); 8.0.0 to 8.0.1-experimental (8.0.1 is outside it)
  • CVE-2023-36665
    Affects 6.10.0 to 6.11.3 (6.11.4 is outside it); 7.0.0 to 7.2.4 (7.2.5 is outside it)
  • CVE-2022-25878
    Affects 6.10.0 to 6.10.2 (6.10.3 is outside it); 6.11.0 to 6.11.2 (6.11.3 is outside it)
  • CVE-2018-3738
    Affects 0.0.0 to 5.0.2 (5.0.3 is outside it); 6.0.0 to 6.8.5 (6.8.6 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-59876Medium 4.8

    protobufjs: Text Format string map parsing can mutate returned map object prototype

    Affected: from 8.2.0, fixed in 8.6.5.

    Fixed in 8.6.5 (released Jun 23, 2026, 15 days before disclosure).

    The latest release, 8.8.1, is not affected.

    0.8% of protobufjs downloads last week were affected versions (1.1M).

  • CVE-2026-59877Medium 5.3

    protobufjs: Denial of Service via infinite loop in .proto option parsing

    Affected: from 7.5.0, fixed in 7.6.5; from 8.0.0, fixed in 8.6.6.

    Fixed in 7.6.5 (released Jul 4, 2026, 4 days before disclosure) and 8.6.6 (released Jul 4, 2026, 4 days before disclosure).

    The latest release, 8.8.1, is not affected.

    29% of protobufjs downloads last week were affected versions (39M).

  • CVE-2026-54269Medium 5.3

    protobufjs: Schema-derived names can shadow runtime-significant properties

    Affected: fixed in 7.6.3; from 8.0.0, fixed in 8.6.0.

    Fixed in 7.6.3 (released Jun 9, 2026, 13 days before disclosure) and 8.6.0 (released Jun 4, 2026, 18 days before disclosure).

    The latest release, 8.8.1, is not affected.

    34% of protobufjs downloads last week were affected versions (45.2M).

  • protobufjs: Denial of service through unbounded Any expansion during JSON conversion

    Affected: fixed in 7.6.1; from 8.0.0, fixed in 8.4.1.

    Fixed in 7.6.1 (released May 22, 2026, 31 days before disclosure) and 8.4.1 (released May 21, 2026, 32 days before disclosure).

    The latest release, 8.8.1, is not affected.

    31% of protobufjs downloads last week were affected versions (41.2M).

  • CVE-2026-54270Medium 5.3

    protobufjs: Memory amplification from preserved unknown fields in binary decode

    Affected: from 8.2.0, fixed in 8.5.0.

    Fixed in 8.5.0 (released May 29, 2026, 24 days before disclosure).

    The latest release, 8.8.1, is not affected.

    0.3% of protobufjs downloads last week were affected versions (444.8K).

  • CVE-2026-45740Medium 5.3

    protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

    Affected: fixed in 7.5.8; from 8.0.0, fixed in 8.2.0.

    Fixed in 7.5.8 (released May 12, 2026, 1 day before disclosure) and 8.2.0 (released May 9, 2026, 4 days before disclosure).

    The latest release, 8.8.1, is not affected.

    29% of protobufjs downloads last week were affected versions (38.5M).

  • CVE-2026-44294Medium 5.3

    protobufjs: Denial of service from crafted field names in generated code

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • protobufjs: Code injection through bytes field defaults in generated toObject code

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • CVE-2026-44292Medium 5.3

    protobufjs: Prototype injection in generated message constructors

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • protobufjs: Code generation gadget after prototype pollution

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • protobufjs: Process-wide denial of service through unsafe option paths

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • protobufjs: Denial of service through unbounded protobuf recursion

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • CVE-2026-44288Medium 5.3

    protobufjs: Overlong UTF-8 decoding

    Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2.

    Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure).

    The latest release, 8.8.1, is not affected.

    27% of protobufjs downloads last week were affected versions (35.8M).

  • CVE-2026-41242Critical 9.4

    protobufjs has an arbitrary code execution issue

    Affected: from 8.0.0, fixed in 8.0.1; from 7.0.0, fixed in 7.5.5; fixed in 6.11.6.

    Fixed in 6.11.6 (released May 3, 2026, 15 days after disclosure), 7.5.5 (released Apr 15, 2026, 3 days before disclosure) and 8.0.1 (released Apr 4, 2026, 14 days before disclosure).

    The latest release, 8.8.1, is not affected.

    23% of protobufjs downloads last week were affected versions (30M).

  • "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.

    Affected: from 7.0.0, fixed in 7.2.5; from 6.10.0, fixed in 6.11.4.

    Fixed in 6.11.4 (released Aug 11, 2023, 37 days after disclosure) and 7.2.5 (released Aug 22, 2023, 48 days after disclosure).

    The latest release, 8.8.1, is not affected.

    2.7% of protobufjs downloads last week were affected versions (3.6M).

Show all 17 advisoriesShow fewer advisories

  • Prototype Pollution

    Affected: from 6.11.0, fixed in 6.11.3; from 6.10.0, fixed in 6.10.3.

    Fixed in 6.10.3 (released May 20, 2022, 7 days before disclosure) and 6.11.3 (released May 20, 2022, 7 days before disclosure).

    The latest release, 8.8.1, is not affected.

    0.4% of protobufjs downloads last week were affected versions (517.7K).

  • protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

    Affected: from 6.0.0, fixed in 6.8.6; fixed in 5.0.3.

    Fixed in 5.0.3 (released May 16, 2018, 22 days before disclosure) and 6.8.6 (released Feb 26, 2018, 101 days before disclosure).

    The latest release, 8.8.1, is not affected.

    <0.1% of protobufjs downloads last week were affected versions (22K).