CVE-2026-59876CWE-1321

protobufjs: Text Format string map parsing can mutate returned map object prototype

Medium · published July 8, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-07-08T15:31Z
EPSS history
Timeline
  • 08 JUL 15:31Z
    protobufjs: Text Format string map parsing can mutate returned map object prototype
    cvelistv5