Vulnerability in Protobufjs Affects JavaScript Functionality

CVE-2026-44288

What is CVE-2026-44288?

The Protobuf.js framework, which compiles protobuf definitions into JavaScript functions, is susceptible to a flaw in its UTF-8 decoding mechanism. Before versions 7.5.6 and 8.0.2, the decoder improperly accepted overlong UTF-8 byte sequences, decoding them into their canonical form instead of rejecting them. This flaw may enable an attacker to craft protobuf binary data that circumvents application-level security checks, allowing potentially unsafe strings to be processed. To address this issue, it is essential to update to the latest versions 7.5.6 or 8.0.2, which rectify these vulnerabilities.

References