JavaScript Functionality Vulnerability in Protobufjs by Protobuf

CVE-2026-54269

What is CVE-2026-54269?

Protobufjs, a library for compiling protocol buffer definitions into JavaScript functions, had an issue where it could accept certain schema-derived names that conflicted with properties used by its runtime helpers. The vulnerability primarily affects fields named 'hasOwnProperty' and service methods where generated helper names could collide with expected properties. As a result, this could lead to unpredictable behavior such as exceptions or recursive calls during various operations, including decoding, verification, and RPC helper invocation. This issue has been addressed in versions 8.6.0 and 7.6.3.

References