Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
17 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected. Impact An attacker who can provide protobuf text-format input parsed by an application using protobufjs/ext/textformat may be able to create message objects whose string-keyed map fields have attacker-controlled prototypes. This is per-object prototype mutation, not global Object.prototype pollution. Impact depends on downstream application logic treating inherited properties as meaningful, for example by using in, truthiness checks, or direct property access on parsed map objects instead of own-property checks. Applications that do not parse untrusted Text Format input, or…
Recommended action: Upgrade to 8.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating. This affects the reflection parsing path (parse, Root.load, Root.loadSync). Impact An attacker who can provide or influence .proto schema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated. Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected. Preconditions - The application must parse .proto schema text influenced by an attacker. - The schema must be parsed through APIs such as parse, Root.load, or Root.loadSync. - The crafted input…
Recommended action: Upgrade to 8.6.6 or 7.6.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into. Impact An attacker who can provide protobuf binary data decoded by an application using affected protobufjs versions may be able to increase memory pressure by sending messages with many unknown fields. This can degrade availability or contribute to…
Recommended action: Upgrade to 8.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. Impact An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow. This affects applications that decode untrusted protobuf input containing google.protobuf.Any values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through JSON.stringify(message), Message#toJSON(), or Type.toObject(message, { json: true }). Applications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.…
Recommended action: Upgrade to 8.4.1 or 7.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. Impact An attacker who can provide or influence protobuf schemas or protobufjs JSON descriptors may be able to make affected message or service types unusable, resulting in denial of service for the affected processing path. Applications using only trusted schemas are affected…
Recommended action: Upgrade to 8.6.0 or 7.6.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. Impact An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow. This affects applications that load JSON descriptors from untrusted sources with affected versions. Preconditions - The application must load JSON descriptor data influenced by an attacker. - The crafted descriptor must contain deeply nested nested namespace objects. - The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input. Workarounds Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested…
Recommended action: Upgrade to 8.2.0 or 7.5.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. Impact An attacker who can provide or influence a protobuf schema or JSON descriptor may be able to make affected message types unusable by causing protobufjs runtime code generation to throw a syntax error. This is a denial of service issue for applications that load untrusted schemas or descriptors. Applications that only use trusted, application-defined schemas are not directly affected by this issue. The issue is not known to allow code execution by itself. Preconditions - The application must allow an attacker to control or influence a protobuf schema or JSON descriptor. - The crafted input must define a field name…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. Impact An attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs. This requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue. Preconditions - The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema. - The descriptor must define a bytes field with an attacker-controlled default value. - The application must call…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the proto key. If an application constructed a message from an attacker-controlled plain object, an own enumerable proto property could alter the prototype of that individual message instance. Impact An attacker who can control the properties object passed to a generated protobufjs message constructor or creation helper may be able to modify the prototype chain of the resulting message instance. This is a per-instance prototype injection issue. It does not pollute Object.prototype or other global prototypes. The impact depends on downstream application behavior, such as relying on inherited properties, prototype methods, or instanceof checks for message objects. Applications that only decode binary protobuf data, or that construct messages from trusted application-defined objects, are not directly affected by this issue. Preconditions - The application…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. Impact An attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution. This issue requires a separate prototype pollution primitive before protobufjs is invoked. Applications without a reachable prototype pollution primitive are not directly exploitable through this issue alone. Preconditions - The application or one of its dependencies must allow an attacker to pollute Object.prototype. - The polluted property must affect protobufjs internal type lookup behavior.…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. Impact An attacker who can provide or influence protobuf schemas or JSON descriptors may be able to corrupt built-in process state in a way that causes subsequent application code or protobufjs code to fail. This can result in a persistent denial of service for the lifetime of the affected process. This issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources. Applications that use bundled, generated, or otherwise trusted schemas to decode untrusted protobuf message payloads are not directly affected. The issue is not known to allow code execution by itself. Preconditions - The application must allow an attacker to control or influence a…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. Impact An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow. This affects applications that decode untrusted protobuf binary input with affected versions. Preconditions - The application must decode protobuf binary data influenced by an attacker. - The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields. - The affected decoder path must process the crafted input. Workarounds Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. The issue concerns overlong encodings and code points outside the Unicode range. protobufjs may still accept some non-strict UTF-8 input for compatibility, so applications should not rely on protobufjs as a general-purpose strict UTF-8 validator. Impact An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. The practical impact depends on downstream application validation and how decoded strings are used. Node.js Buffer-backed decoding paths are not directly affected when they use Node's native UTF-8…
Recommended action: Upgrade to 8.0.2 or 7.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach runtime code generation without sufficient validation. Impact An attacker who can provide a malicious protobuf definition or JSON descriptor to an application may be able to execute arbitrary JavaScript in the context of the process using protobufjs. This requires control over the protobuf schema or descriptor being loaded. Applications that only decode messages using trusted, application-defined schemas are not directly affected by this issue. Preconditions - The application must allow an attacker to control or influence a protobuf definition or JSON descriptor. - The application must load that definition through protobufjs reflection APIs such as descriptor loading. - The affected generated-code path must be reached, for example by performing an operation on the loaded type. Workarounds…
Recommended action: Upgrade to 8.0.1, 7.5.5 or 6.11.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about Object.constructor.prototype.<new-property = ...; whereas CVE-2022-25878 was about Object.proto.<new-property = ...; instead.
Recommended action: Upgrade to 7.2.5 or 6.11.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Recommended action: Upgrade to 6.11.3 or 6.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later.
Recommended action: Upgrade to 6.8.6 or 5.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.