CVE-2026-44294

What it actually does

protobufjs versions before 7.5.6 and 8.0.2 improperly escape certain control characters when turning schema-controlled field or oneof names into dynamically generated JavaScript functions. If an application compiles an attacker-supplied .proto schema or JSON descriptor, crafted names can be embedded into generated encode, decode, verify, or conversion function bodies in a way that causes JavaScript compilation to fail. The primary technical effect is availability degradation: affected parsing or serialization paths may throw exceptions, fail requests, disable dependent message handling, or crash a process if errors are not safely handled. The flaw is not known to provide code execution, data theft, or data modification by itself.

Why it matters to the business

Applications that accept or process untrusted protobuf schemas or descriptors may be vulnerable to denial-of-service conditions. An attacker could cause message-processing features, APIs, queues, ingestion pipelines, developer tooling, or schema import workflows to fail until the malformed schema is rejected, the service is restarted, or the package is upgraded. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no exploit maturity is reported, so urgency is highest for internet-facing or multi-tenant systems that compile user-provided protobuf definitions.

How an attack unfolds

An attacker first identifies an application feature, API, build process, schema registry, plugin interface, import workflow, or service endpoint that accepts protobuf definitions or JSON descriptors and compiles them with protobufjs. The attacker submits a crafted schema or descriptor containing field or oneof names with control characters that are not escaped correctly by vulnerable protobufjs versions. When the application invokes protobufjs to generate encode, decode, verify, or conversion functions, the generated JavaScript function body becomes syntactically invalid and fails compilation. If the application does not catch and isolate that failure, the request fails, the schema-processing worker may terminate, or downstream message processing may be disrupted. Repeated submissions can be used to sustain service degradation, but the vulnerability does not inherently grant unauthorized access or remote code execution.

How to fix it

Upgrade protobufjs to a fixed release: 7.5.6 or later on the 7.x line, or 8.0.2 or later on the 8.x line. Rebuild and redeploy applications that bundle protobufjs directly or through transitive dependencies, and refresh lockfiles or package manager resolutions where needed. If immediate upgrade is not possible, prevent untrusted users from supplying protobuf schemas or JSON descriptors, validate field and oneof names against a strict safe-character allowlist before compilation, reject control characters in schema-derived identifiers, run schema compilation in an isolated worker with timeouts and crash containment, and ensure exceptions from protobufjs compilation are handled without terminating critical processes.

How to confirm the fix worked

Confirm the deployed dependency tree resolves protobufjs to 7.5.6 or later, or 8.0.2 or later. Use package-manager inspection commands such as npm ls protobufjs, yarn why protobufjs, pnpm why protobufjs, or software composition analysis results to verify there are no vulnerable transitive copies in production artifacts. Validate that lockfiles, containers, serverless bundles, and compiled application packages contain the fixed version. Test negative controls by attempting to import malformed schemas with control characters in field or oneof names and confirming the application rejects them cleanly, logs a controlled validation error, and does not crash or disrupt unrelated requests.

Typical attack path

1. Identify an application or service that uses protobufjs and accepts externally supplied .proto files, protobuf schemas, or JSON descriptors.
2. Submit or upload a crafted schema containing field or oneof names with problematic control characters.
3. Trigger protobufjs schema compilation or runtime generation of encode, decode, verify, or conversion functions.
4. Cause JavaScript function compilation to throw a syntax or compilation error.
5. Abuse unhandled errors, retries, or worker crashes to disrupt availability of the affected feature or service.

How to detect it

Look for evidence that untrusted protobuf schemas or JSON descriptors were submitted shortly before protobufjs compilation failures, request failures, worker restarts, or crashes. Useful log sources include application logs, API gateway and reverse proxy logs for schema upload/import endpoints, schema registry audit logs, CI/CD or build logs that compile protobuf definitions, container restart events, process supervisor logs, and error monitoring platforms. Investigate spikes in JavaScript SyntaxError or compilation errors associated with protobufjs, especially when paired with user-submitted .proto files, JSON descriptors, or repeated requests from the same IP, account, token, or automation client. Review uploaded schema artifacts for field or oneof names containing ASCII control characters, escaped Unicode control sequences, newlines, carriage returns, tabs, null bytes, or other non-printable characters. Because the vulnerability mainly causes denial of service and does not create a stable host-level artifact, detection should focus on malformed schema submissions plus resulting protobufjs code-generation failures.

• protobufjs
• SyntaxError: Invalid or unexpected token
• SyntaxError: Unexpected token
• SyntaxError: Unexpected end of input
• at Function (<anonymous>)
• new Function
• failed to compile
• schema compilation failed
• descriptor compilation failed
• encode function compilation failed
• decode function compilation failed
• verify function compilation failed
• fromObject function compilation failed
• toObject function compilation failed
• oneof
• field name contains control character
• Invalid field name
• Invalid oneof name
• \u0000
• \u000a
• \u000d
• \u0009

What your security team should do

• Inventory applications, services, CLIs, build systems, schema registries, and ingestion pipelines that use protobufjs, including transitive dependencies.
• Prioritize upgrades for internet-facing, partner-facing, multi-tenant, or automated systems that compile protobuf schemas or JSON descriptors from untrusted sources.
• Upgrade protobufjs to 7.5.6 or later, or 8.0.2 or later, and rebuild all deployable artifacts that may contain bundled vulnerable code.
• Add input validation that rejects control characters and nonconforming identifiers in schema-controlled field and oneof names before invoking protobufjs.
• Review error handling around schema compilation so malformed input cannot crash long-running processes or shared workers.
• Search historical logs for protobufjs compilation errors, syntax errors during schema import, and repeated malformed schema submissions from the same source.
• Add monitoring and rate limiting to schema upload/import endpoints to reduce the impact of repeated denial-of-service attempts.