protobufjs vulnerabilities

Newest CVEs

• CVE-2026-59876

  protobufjs: Text Format string map parsing can mutate returned map object prototype

  protobufjs · protobuf.js

  Medium4.8
• CVE-2026-59877

  protobufjs: Denial of Service via infinite loop in .proto option parsing

  protobufjs · protobuf.js

  Medium5.3
• CVE-2026-54269

  protobufjs: Schema-derived names can shadow runtime-significant properties

  protobufjs · protobuf.js

  Medium5.3
• CVE-2026-48712

  protobufjs: Denial of service through unbounded Any expansion during JSON conversion

  protobufjs · protobuf.js

  High7.5
• CVE-2026-54270

  protobufjs: Memory amplification from preserved unknown fields in binary decode

  protobufjs · protobuf.js

  Medium5.3
• CVE-2026-54271

  protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

  protobufjs · protobufjs-cli

  High8.2
• CVE-2026-44295

  protobufjs-cli: Code injection in pbjs static output from crafted schema names

  protobufjs · protobuf.js

  High8.7
• CVE-2026-42290

  protobufjs-cli: OS Command Injection

  protobufjs · protobuf.js

  High7.8
• CVE-2026-45740

  protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

  protobufjs · protobuf.js

  Medium5.3
• CVE-2026-44294

  protobufjs: Denial of service from crafted field names in generated code

  protobufjs · protobuf.js

  Medium5.3