CVE-2026-44294CWE-20

protobufjs: Denial of service from crafted field names in generated code

Medium · published May 13, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-05-13T14:44Z
EPSS history
Timeline
  • 13 MAY 14:44Z
    protobufjs: Denial of service from crafted field names in generated code
    cvelistv5