protobufjs vulnerabilitiesprotobufjs: known vulnerabilities and safe versions

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

• CVE-2026-598772026-07-08

  protobufjs: Denial of Service via infinite loop in .proto option parsing

  Affected versions: >= 7.5.0, < 7.6.5 · >= 8.0.0, < 8.6.6

  high 7.5

  Fixed in: 7.6.5, 8.6.6

• CVE-2026-598762026-07-08

  protobufjs: Text Format string map parsing can mutate returned map object prototype

  Affected versions: >= 8.2.0, < 8.6.5

  medium 4.8

  Fixed in: 8.6.5

• CVE-2026-542702026-06-22

  protobufjs: Memory amplification from preserved unknown fields in binary decode

  Affected versions: >= 8.2.0, < 8.5.0

  medium 5.3

  Fixed in: 8.5.0

• CVE-2026-542692026-06-22

  protobufjs: Schema-derived names can shadow runtime-significant properties

  Affected versions: < 7.6.3 · >= 8.0.0, < 8.6.0

  medium 5.3

  Fixed in: 7.6.3, 8.6.0

• CVE-2026-487122026-06-22

  protobufjs: Denial of service through unbounded Any expansion during JSON conversion

  Affected versions: < 7.6.1 · >= 8.0.0, < 8.4.1

  high 7.5

  Fixed in: 7.6.1, 8.4.1

• CVE-2026-457402026-05-13

  protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

  Affected versions: < 7.5.8 · >= 8.0.0, < 8.2.0

  high 7.5

  Fixed in: 7.5.8, 8.2.0

• CVE-2026-442942026-05-13

  protobufjs: Denial of service from crafted field names in generated code

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  medium 5.3

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442932026-05-13

  protobufjs: Code injection through bytes field defaults in generated toObject code

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  high 7.7

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442922026-05-13

  protobufjs: Prototype injection in generated message constructors

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  medium 5.3

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442912026-05-13

  protobufjs: Code generation gadget after prototype pollution

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  high 8.1

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442902026-05-13

  protobufjs: Process-wide denial of service through unsafe option paths

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  high 7.5

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442892026-05-13

  protobufjs: Denial of service through unbounded protobuf recursion

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  high 7.5

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-442882026-05-13

  protobufjs: Overlong UTF-8 decoding

  Affected versions: < 7.5.6 · >= 8.0.0, < 8.0.2

  medium 5.3

  Fixed in: 7.5.6, 8.0.2

• CVE-2026-41242exploit code exists2026-04-18

  protobufjs has an arbitrary code execution issue

  Affected versions: >= 8.0.0, < 8.0.1 · < 7.5.5

  critical 9.4

  Fixed in: 7.5.5, 8.0.1

• CVE-2023-366652023-07-05

  "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.

  Affected versions: >= 7.0.0, < 7.2.5 · >= 6.10.0, < 6.11.4

  critical 9.8

  Fixed in: 6.11.4, 7.2.5

  EPSS 1.6%

• CVE-2022-258782022-05-27

  The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Objec

  Affected versions: >= 6.11.0, < 6.11.3 · >= 6.10.0, < 6.10.3

  high 7.5

  Fixed in: 6.10.3, 6.11.3

  EPSS 2.3%

• CVE-2018-37382018-06-06

  protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

  Affected versions: >= 6.0.0, < 6.8.6 · < 5.0.3

  medium 5.5

  Fixed in: 5.0.3, 6.8.6