What’s Vulnerable › Vulnerabilities

CVE-2026-59876: protobufjs: Text Format string map parsing can mutate returned map object prototype

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-1321

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

Affected products

• protobufjs: from 8.2.0 before 8.6.5 — fixed in 8.6.5

How to fix

Upgrade to a fixed version: protobufjs 8.6.5. Check the vendor advisory for mitigations.

References

• https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8
• https://github.com/protobufjs/protobuf.js/pull/2335
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934

Get alerted when CVE-2026-59876 or the next vulnerability affects your stack