protobufjs vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest protobufjs vulnerabilities

CVE-2026-59877 — protobufjs: Denial of Service via infinite loop in .proto option parsing (CVSS 7.5)
CVE-2026-59876 — protobufjs: Text Format string map parsing can mutate returned map object prototype (CVSS 4.8)
CVE-2026-54270 — protobufjs: Memory amplification from preserved unknown fields in binary decode (CVSS 5.3)
CVE-2026-54269 — protobufjs: Schema-derived names can shadow runtime-significant properties (CVSS 5.3)
CVE-2026-48712 — protobufjs: Denial of service through unbounded Any expansion during JSON conversion (CVSS 7.5)
CVE-2026-45740 — protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion (CVSS 7.5)
CVE-2026-44294 — protobufjs: Denial of service from crafted field names in generated code (CVSS 5.3)
CVE-2026-44293 — protobufjs: Code injection through bytes field defaults in generated toObject code (CVSS 8.8)
CVE-2026-44292 — protobufjs: Prototype injection in generated message constructors (CVSS 5.3)
CVE-2026-44291 — protobufjs: Code generation gadget after prototype pollution (CVSS 8.1)
CVE-2026-44290 — protobufjs: Process-wide denial of service through unsafe option paths (CVSS 7.5)
CVE-2026-44289 — protobufjs: Denial of service through unbounded protobuf recursion (CVSS 7.5)
CVE-2026-44288 — protobufjs: Overlong UTF-8 decoding (CVSS 5.3)
CVE-2026-41242 — protobufjs has an arbitrary code execution issue (CVSS 9.8)
CVE-2023-36665 — (CVSS 9.8)
CVE-2022-25878 — Prototype Pollution (CVSS 7.5)
CVE-2018-3738 — (CVSS 5.5)