# protobufjs (npm) vulnerabilities 17 known vulnerabilities (1 critical, 6 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.8.1 (Oct 11, 2026): no advisory affects it - Newest unaffected release: 8.8.1 (Oct 11, 2026), the latest release - Weekly downloads: 123.6M - Dependents: 2,838 - Releases: 221 since 0.0.0 (Mar 1, 2013) - Registry: https://www.npmjs.com/package/protobufjs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-59876: 8.2.0 to 8.6.4 (8.6.5 is outside it) - CVE-2026-59877: 7.5.0 to 7.6.4 (7.6.5 is outside it); 8.0.0 to 8.6.5 (8.6.6 is outside it) - CVE-2026-54269: 0.0.0 to 7.6.2 (7.6.3 is outside it); 8.0.0 to 8.5.0 (8.6.0 is outside it) - CVE-2026-48712: 0.0.0 to 7.6.0 (7.6.1 is outside it); 8.0.0 to 8.4.0 (8.4.1 is outside it) - CVE-2026-54270: 8.2.0 to 8.4.2 (8.5.0 is outside it) - CVE-2026-45740: 0.0.0 to 7.5.7 (7.5.8 is outside it); 8.0.0 to 8.1.6-experimental (8.2.0 is outside it) - CVE-2026-44294: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44293: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44292: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44291: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44290: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44289: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-44288: 0.0.0 to 7.5.5 (7.5.6 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-41242: 0.0.0 to 6.11.5 (6.11.6 is outside it); 7.0.0 to 7.5.4 (7.5.5 is outside it); 8.0.0 to 8.0.1-experimental (8.0.1 is outside it) - CVE-2023-36665: 6.10.0 to 6.11.3 (6.11.4 is outside it); 7.0.0 to 7.2.4 (7.2.5 is outside it) - CVE-2022-25878: 6.10.0 to 6.10.2 (6.10.3 is outside it); 6.11.0 to 6.11.2 (6.11.3 is outside it) - CVE-2018-3738: 0.0.0 to 5.0.2 (5.0.3 is outside it); 6.0.0 to 6.8.5 (6.8.6 is outside it) ## Advisories (17) ### [CVE-2026-59876](https://cve.now/CVE-2026-59876): protobufjs: Text Format string map parsing can mutate returned map object prototype - Severity: Medium 4.8 - Published: Jul 8, 2026 - Affected: from 8.2.0, fixed in 8.6.5. - Fixed in 8.6.5 (released Jun 23, 2026, 15 days before disclosure). - The latest release, 8.8.1, is not affected. - 0.8% of protobufjs downloads last week were affected versions (1.1M). ### [CVE-2026-59877](https://cve.now/CVE-2026-59877): protobufjs: Denial of Service via infinite loop in .proto option parsing - Severity: Medium 5.3 - Published: Jul 8, 2026 - Affected: from 7.5.0, fixed in 7.6.5; from 8.0.0, fixed in 8.6.6. - Fixed in 7.6.5 (released Jul 4, 2026, 4 days before disclosure) and 8.6.6 (released Jul 4, 2026, 4 days before disclosure). - The latest release, 8.8.1, is not affected. - 29% of protobufjs downloads last week were affected versions (39M). ### [CVE-2026-54269](https://cve.now/CVE-2026-54269): protobufjs: Schema-derived names can shadow runtime-significant properties - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: fixed in 7.6.3; from 8.0.0, fixed in 8.6.0. - Fixed in 7.6.3 (released Jun 9, 2026, 13 days before disclosure) and 8.6.0 (released Jun 4, 2026, 18 days before disclosure). - The latest release, 8.8.1, is not affected. - 34% of protobufjs downloads last week were affected versions (45.2M). ### [CVE-2026-48712](https://cve.now/CVE-2026-48712): protobufjs: Denial of service through unbounded Any expansion during JSON conversion - Severity: High 7.5 - Published: Jun 22, 2026 - Affected: fixed in 7.6.1; from 8.0.0, fixed in 8.4.1. - Fixed in 7.6.1 (released May 22, 2026, 31 days before disclosure) and 8.4.1 (released May 21, 2026, 32 days before disclosure). - The latest release, 8.8.1, is not affected. - 31% of protobufjs downloads last week were affected versions (41.2M). ### [CVE-2026-54270](https://cve.now/CVE-2026-54270): protobufjs: Memory amplification from preserved unknown fields in binary decode - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: from 8.2.0, fixed in 8.5.0. - Fixed in 8.5.0 (released May 29, 2026, 24 days before disclosure). - The latest release, 8.8.1, is not affected. - 0.3% of protobufjs downloads last week were affected versions (444.8K). ### [CVE-2026-45740](https://cve.now/CVE-2026-45740): protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - Severity: Medium 5.3 - Published: May 13, 2026 - Affected: fixed in 7.5.8; from 8.0.0, fixed in 8.2.0. - Fixed in 7.5.8 (released May 12, 2026, 1 day before disclosure) and 8.2.0 (released May 9, 2026, 4 days before disclosure). - The latest release, 8.8.1, is not affected. - 29% of protobufjs downloads last week were affected versions (38.5M). ### [CVE-2026-44294](https://cve.now/CVE-2026-44294): protobufjs: Denial of service from crafted field names in generated code - Severity: Medium 5.3 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44293](https://cve.now/CVE-2026-44293): protobufjs: Code injection through bytes field defaults in generated toObject code - Severity: High 7.7 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44292](https://cve.now/CVE-2026-44292): protobufjs: Prototype injection in generated message constructors - Severity: Medium 5.3 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44291](https://cve.now/CVE-2026-44291): protobufjs: Code generation gadget after prototype pollution - Severity: High 8.1 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44290](https://cve.now/CVE-2026-44290): protobufjs: Process-wide denial of service through unsafe option paths - Severity: High 7.5 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44289](https://cve.now/CVE-2026-44289): protobufjs: Denial of service through unbounded protobuf recursion - Severity: High 7.5 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-44288](https://cve.now/CVE-2026-44288): protobufjs: Overlong UTF-8 decoding - Severity: Medium 5.3 - Published: May 13, 2026 - Affected: fixed in 7.5.6; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.6 (released Apr 28, 2026, 15 days before disclosure) and 8.0.2 (released Apr 27, 2026, 16 days before disclosure). - The latest release, 8.8.1, is not affected. - 27% of protobufjs downloads last week were affected versions (35.8M). ### [CVE-2026-41242](https://cve.now/CVE-2026-41242): protobufjs has an arbitrary code execution issue - Severity: Critical 9.4 - Published: Apr 18, 2026 - Affected: from 8.0.0, fixed in 8.0.1; from 7.0.0, fixed in 7.5.5; fixed in 6.11.6. - Fixed in 6.11.6 (released May 3, 2026, 15 days after disclosure), 7.5.5 (released Apr 15, 2026, 3 days before disclosure) and 8.0.1 (released Apr 4, 2026, 14 days before disclosure). - The latest release, 8.8.1, is not affected. - 23% of protobufjs downloads last week were affected versions (30M). ### [CVE-2023-36665](https://cve.now/CVE-2023-36665): "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. - Severity: Unrated - Published: Jul 5, 2023 - Affected: from 7.0.0, fixed in 7.2.5; from 6.10.0, fixed in 6.11.4. - Fixed in 6.11.4 (released Aug 11, 2023, 37 days after disclosure) and 7.2.5 (released Aug 22, 2023, 48 days after disclosure). - The latest release, 8.8.1, is not affected. - 2.7% of protobufjs downloads last week were affected versions (3.6M). ### [CVE-2022-25878](https://cve.now/CVE-2022-25878): Prototype Pollution - Severity: High 8.2 - Published: May 27, 2022 - Affected: from 6.11.0, fixed in 6.11.3; from 6.10.0, fixed in 6.10.3. - Fixed in 6.10.3 (released May 20, 2022, 7 days before disclosure) and 6.11.3 (released May 20, 2022, 7 days before disclosure). - The latest release, 8.8.1, is not affected. - 0.4% of protobufjs downloads last week were affected versions (517.7K). ### [CVE-2018-3738](https://cve.now/CVE-2018-3738): protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. - Severity: Unrated - Published: Jun 7, 2018 - Affected: from 6.0.0, fixed in 6.8.6; fixed in 5.0.3. - Fixed in 5.0.3 (released May 16, 2018, 22 days before disclosure) and 6.8.6 (released Feb 26, 2018, 101 days before disclosure). - The latest release, 8.8.1, is not affected. - <0.1% of protobufjs downloads last week were affected versions (22K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/protobufjs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.