Memory Retention Vulnerability in Protobuf.js by ProtobufJS

CVE-2026-54270

What is CVE-2026-54270?

The protobuf.js library, versions 8.2.0 to 8.4.2, exhibited a vulnerability where unknown wire elements were retained in message.$unknowns during decoding. This behavior could lead to excessive memory consumption due to unneeded retention of these fields when processing protobuf payloads. The issue was addressed in version 8.5.0, which introduced decode-time options to allow developers to specify whether to retain or discard unknown fields. Further improvements in version 8.6.2 changed the default behavior to discard these unknown fields, mitigating the risks associated with memory bloat significantly.

References