CVE-2026-44290

What it actually does

The flaw is an improper input validation issue in protobufjs option handling. When protobufjs compiles or loads a crafted Protocol Buffers schema or JSON descriptor, certain schema option paths can traverse inherited JavaScript object properties. This can allow writes to global JavaScript constructors or prototypes, corrupting process-wide built-in behavior. The primary impact is availability: a malicious descriptor can cause application crashes, unpredictable runtime errors, or denial of service in Node.js or browser-based applications that process untrusted protobuf schemas.

Why it matters to the business

Applications that accept or process protobuf schemas from users, partners, plugins, CI pipelines, build systems, or external services may be crashed remotely without authentication if the schema is parsed by a vulnerable protobufjs version. The CVSS score indicates high availability impact, but current public exploitation signals are low: EPSS is 0.00374, it is not in CISA KEV, and no mature exploit is reported. Organizations with developer platforms, API gateways, schema registries, build automation, or multi-tenant services that ingest protobuf definitions should still prioritize patching because a single malicious schema can disrupt service availability.

How an attack unfolds

An attacker first identifies an application, service, build process, or developer workflow that uses protobufjs before versions 7.5.6 or 8.0.2 and accepts protobuf schemas or JSON descriptors from an untrusted or semi-trusted source. The attacker crafts a protobuf definition or JSON descriptor containing option paths that resolve through inherited JavaScript properties rather than only expected own properties. When the vulnerable protobufjs parser/compiler applies those options, it writes into global JavaScript constructors or prototype-linked objects. Because these objects are shared process-wide, normal application code can begin failing as built-in behavior is corrupted. The likely attacker objective is denial of service through application exceptions, failed schema compilation, broken request handling, worker crashes, or process termination.

How to fix it

Upgrade protobufjs to a fixed release: use protobufjs 7.5.6 or later on the 7.x line, or protobufjs 8.0.2 or later on the 8.x line. Regenerate lockfiles and redeploy all applications, containers, serverless functions, and build images that bundle vulnerable versions. If immediate upgrade is not possible, avoid processing protobuf schemas or JSON descriptors from untrusted sources, restrict schema upload/import capabilities to trusted administrators, validate descriptors before loading, and isolate schema compilation in a sandboxed worker process with crash containment and resource limits. Ensure transitive dependency copies are also remediated, because protobufjs is commonly included indirectly through JavaScript and TypeScript package dependency trees.

How to confirm the fix worked

Confirm remediation by inspecting package manifests and lockfiles for protobufjs versions and verifying that all resolved copies are 7.5.6 or later, or 8.0.2 or later. Use dependency scanners such as npm audit, osv-scanner, Snyk, Dependabot, or software composition analysis tooling to confirm no vulnerable protobufjs package remains in production artifacts. Validate deployed containers and build images, not only source repositories. Where feasible, run a negative test by attempting to process a controlled malicious descriptor in a non-production environment and confirming that protobufjs rejects or safely handles it without modifying global prototypes or crashing the process. Monitor application error rates after deployment to confirm the fix does not introduce schema compatibility issues.

Typical attack path

1. Find an application, API, schema registry, plugin system, CI job, or build service that uses protobufjs to parse user-controllable .proto files or JSON descriptors.
2. Confirm or infer that the deployed dependency version is protobufjs before 7.5.6 or before 8.0.2.
3. Create a malicious protobuf schema or JSON descriptor with crafted option paths that traverse inherited JavaScript object properties.
4. Submit, upload, import, or cause the application to process the malicious schema.
5. Trigger protobufjs option application during schema parsing, loading, or compilation.
6. Corrupt global JavaScript constructor or prototype behavior inside the affected process.
7. Cause service errors, failed builds, worker crashes, degraded request handling, or denial of service.

How to detect it

To determine whether exploitation may have already occurred, review logs and artifacts from services that parse protobuf schemas or JSON descriptors. Focus on application logs, API gateway logs, upload/import audit logs, CI/CD job logs, schema registry events, container stdout/stderr, Node.js process manager logs, and crash reports. Look for suspicious schema submissions containing prototype-pollution-style property paths such as __proto__, constructor, or prototype in protobuf options or JSON descriptors. Correlate these submissions with sudden TypeError exceptions, schema compilation failures, worker restarts, Node.js process crashes, container restarts, HTTP 500 spikes, or build failures. If source artifacts are retained, inspect uploaded .proto files and JSON descriptors around the time of outages. Also search dependency and deployment records to identify vulnerable protobufjs versions in services that experienced unexplained availability incidents.

• protobufjs@7.5.5
• protobufjs@7.5.4
• protobufjs@7.5.3
• protobufjs@7.5.2
• protobufjs@7.5.1
• protobufjs@7.5.0
• protobufjs@8.0.1
• protobufjs@8.0.0
• "protobufjs": "7.5.5"
• "protobufjs": "8.0.1"
• __proto__
• constructor.prototype
• prototype.constructor
• TypeError: Cannot assign to read only property
• TypeError: Cannot set properties of undefined
• TypeError: Cannot convert object to primitive value
• RangeError: Maximum call stack size exceeded

What your security team should do

• Inventory JavaScript, TypeScript, Node.js, browser, container, and build-system components that include protobufjs directly or transitively.
• Prioritize systems that parse protobuf schemas, .proto files, JSON descriptors, plugins, API definitions, or uploaded developer artifacts from external or semi-trusted users.
• Upgrade protobufjs to 7.5.6 or later, or 8.0.2 or later, and redeploy affected runtime and build environments.
• Search lockfiles for multiple protobufjs copies and ensure every resolved dependency instance is remediated.
• Temporarily disable or restrict untrusted schema upload/import workflows until patched.
• Add input validation and authorization controls around schema submission endpoints and developer automation jobs.
• Run software composition analysis in CI to block reintroduction of vulnerable protobufjs versions.
• Review recent application crashes, schema parsing errors, and anomalous protobuf descriptor submissions for signs of attempted exploitation.
• Because this is not currently in KEV and EPSS is low, coordinate patching through normal high-priority dependency remediation unless affected services ingest untrusted schemas, in which case treat as urgent.