5.3Media
CVE-2026-44292protobufjs: Prototype injection in generated message constructors
Descripción
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Debilidad (CWE):
CWE-1321
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| protobufjs | protobuf.js | < 7.5.6, >= 8.0.0, < 8.0.2 | |
| protobufjs project | protobufjs | < 7.5.6 |
Referencias y parches
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w MitigationVendor Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*< 7.5.6cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.0.2