What’s Vulnerable › Vulnerabilities
CVE-2026-54270: protobufjs: Memory amplification from preserved unknown fields in binary decode
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-10-25
- Weakness: CWE-770
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.
Affected products
- protobufjs: from 8.2.0 before 8.5.0 — fixed in 8.5.0
How to fix
Upgrade to a fixed version: protobufjs 8.5.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-54270 or the next vulnerability affects your stack