CVE-2026-44290CWE-1321

protobufjs: Process-wide denial of service through unsafe option paths

High · published May 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-05-13T14:41Z
EPSS history
Timeline
  • 13 MAY 14:41Z
    protobufjs: Process-wide denial of service through unsafe option paths
    cvelistv5