CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2026-44292
Medium (5.3) in protobufjs project protobufjs. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in protobufjs 7.5.6, 8.0.2.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- protobufjs_project:protobufjs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fx83-v9x8-x52w | npm | protobufjs | <7.5.6 | 7.5.6 |
| GHSA-fx83-v9x8-x52w | npm | protobufjs | >=8.0.0 <8.0.2 | 8.0.2 |