CVE-2026-44292

What it actually does

The vulnerability allows for a limited form of prototype pollution in JavaScript applications using protobufjs. An attacker can supply a crafted plain object with an enumerable `__proto__` property during message construction. The library fails to filter this key, leading to the modification of the prototype of the individual message instance being created. This can alter the object's properties and methods, potentially leading to logic flaws, but does not affect the global Object prototype.

Why it matters to the business

Applications processing untrusted data with a vulnerable version of protobufjs may be susceptible to data integrity issues or business logic bypasses. An attacker could manipulate the behavior of specific operations, such as transaction processing or authorization checks, by altering the properties of data objects in-flight. While the CVSS score is medium and direct impact is limited, this could serve as a weak link in the application's security, potentially enabling more complex attacks.

How an attack unfolds

An attacker targets an application endpoint that accepts structured data (e.g., JSON) and uses a vulnerable version of protobufjs for deserialization. The attacker crafts a malicious payload containing a `__proto__` key, which points to an object with properties they wish to inject. When the backend service uses protobufjs to create a message from this payload, the library incorrectly copies the `__proto__` property, thereby polluting the newly created message instance's prototype. Subsequent code that interacts with this object may now execute with unintended logic. For example, a check for `if (message.isAdmin)` could unexpectedly pass if the attacker polluted the prototype with `isAdmin: true`.

How to fix it

Upgrade the protobufjs library to a patched version. The vulnerability is fixed in versions 7.5.6 and 8.0.2. For projects using the 7.x branch, update to version 7.5.6 or later. For projects using the 8.x branch, update to 8.0.2 or later. Update the dependency in your project's `package.json` file and run the appropriate package manager command (e.g., `npm install` or `yarn upgrade`) to install the fixed version.

How to confirm the fix worked

To validate the fix, inspect the project's dependency lock file (e.g., `package-lock.json` or `yarn.lock`) to ensure that the resolved version of `protobufjs` is 7.5.6+ or 8.0.2+. To detect exposure, use a Software Composition Analysis (SCA) tool to scan for vulnerable versions of `protobufjs` across all codebases. A programmatic test can also be written to attempt to construct a message with a `{"__proto__": {"polluted": true}}` payload and assert that the `polluted` property is not present on the resulting object.

Typical attack path

1. An attacker identifies an application using a vulnerable version of the protobufjs library to process user-controlled input.
2. The attacker crafts a malicious plain object or JSON payload containing a `__proto__` key.
3. The payload is sent to the application, for example, via an API endpoint.
4. The vulnerable protobufjs library processes the payload and creates a message object.
5. During creation, the `__proto__` property from the payload is used to modify the prototype of the new message instance.
6. Downstream application logic that relies on the properties of this object now behaves in an unexpected way, potentially leading to a security control bypass or data corruption.

How to detect it

Exploitation attempts can be detected by monitoring network traffic and application logs for inbound requests containing suspicious property names. Specifically, look for JSON or object literals in request bodies that include `__proto__` as a key. While not always malicious, its presence in user-supplied data is a strong indicator of a potential prototype pollution attempt. Correlate these findings with any subsequent application errors or anomalous behavior.

• "__proto__":

What your security team should do

• Use a Software Composition Analysis (SCA) tool to identify all applications using vulnerable versions of protobufjs and prioritize them for patching.
• Instruct development teams to upgrade protobufjs to version 7.5.6+ or 8.0.2+ immediately.
• Recommend development teams implement automated dependency scanning in CI/CD pipelines to prevent the introduction of new vulnerable components.