- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 4 · 3 high, 1 medium
- Weekly downloads
- 2.3M
- Dependents
- 36
- Registry
- npm
Advisories 4
- CVE-2026-54269Medium 5.3
protobufjs: Schema-derived names can shadow runtime-significant properties
Affected: from 2.0.0, fixed in 2.5.1; fixed in 1.3.3.
- CVE-2026-54271High 8.2
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
Affected: fixed in 1.3.2; from 2.0.0, fixed in 2.5.0.
- CVE-2026-44295High 8.7
protobufjs-cli: Code injection in pbjs static output from crafted schema names
Affected: fixed in 1.2.1; from 2.0.0, fixed in 2.0.2.
- CVE-2026-42290High 7.8
protobufjs-cli: OS Command Injection
Affected: fixed in 1.2.1; from 2.0.0, fixed in 2.0.2.