Prototype Pollution in Protobuf.js Affects Multiple Versions

CVE-2026-44291

What is CVE-2026-44291?

Protobuf.js, a popular library for compiling protocol buffer definitions into JavaScript functions, has a vulnerability that arises from the use of plain objects with inherited prototypes for internal type lookup tables prior to versions 7.5.6 and 8.0.2. This design flaw allows an attacker to manipulate Object.prototype, potentially leading to the resolution of attacker-controlled inherited properties as valid protobuf type information. Consequently, this exploit could cause malicious strings to be injected into the generated JavaScript code, resulting in significant security risks. Users are advised to upgrade to the latest versions to mitigate this vulnerability.

References