GHSA-f38q-mgvj-vph7
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
protobufjs : Schema-derived names can shadow runtime-significant properties
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | protobufjs | 0 | 7.6.3 |
| npm | protobufjs | 8.0.0 | 8.6.0 |
| npm | protobufjs-cli | 0 | 1.3.3 |
| npm | protobufjs-cli | 2.0.0 | 2.5.1 |
Related vulnerabilities
- CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Same vulnerability
- CVE-2026-54270 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs
- CVE-2026-48712 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs
- GHSA-94rc-8x27-4472 protobufjs: Memory amplification from preserved unknown fields in binary decode Also affects protobufjs
- GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion Also affects protobufjs
- GHSA-jggg-4jg4-v7c6 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion Also affects protobufjs
- CVE-2026-45740 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs
- CVE-2026-44294 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs