Vulnerability index

Browse CVEs

19 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Protobufjs HIGH 7.5
CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing throug…

Fix: 7.6.5 / 8.6.6+
Fix from $1,950 2026-07-08
Protobufjs Cli HIGH 8.2
CVE-2026-54271

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-…

Fix: 1.3.2 / 2.5.0+
Fix from $1,950 2026-06-22
Protobufjs MEDIUM 5.3
CVE-2026-54269

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names t…

Fix: 1.3.3 / 2.5.1+
Fix from $1,600 2026-06-22
Protobufjs MEDIUM 5.3
CVE-2026-54270

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$…

Fix: 8.5.0+
Fix from $1,600 2026-06-22
Protobufjs HIGH 7.5
CVE-2026-48712

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit whi…

Fix: 7.6.1 / 8.4.1+
Fix from $1,950 2026-06-22
Protobufjs HIGH 7.5
CVE-2026-45740

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit whi…

Fix: 7.5.8 / 8.2.0+
Fix from $1,950 2026-05-13
Protobufjs HIGH 8.8
CVE-2026-44293

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conve…

Fix: 7.5.6 / 8.0.2+
Fix from $1,950 2026-05-13
Protobufjs Cli HIGH 8.7
CVE-2026-44295

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identif…

Fix: 1.2.1 / 2.0.2+
Fix from $1,950 2026-05-13
Protobufjs MEDIUM 5.3
CVE-2026-44292

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied e…

Fix: 7.5.6 / 8.0.2+
Fix from $1,600 2026-05-13
Protobufjs MEDIUM 5.3
CVE-2026-44294

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors…

Fix: 7.5.6 / 8.0.2+
Fix from $1,600 2026-05-13
Protobufjs HIGH 8.1
CVE-2026-44291

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited proto…

Fix: 7.5.6 / 8.0.2+
Fix from $1,950 2026-05-13
Protobufjs HIGH 7.5
CVE-2026-44289

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit whi…

Fix: 7.5.6 / 8.0.2+
Fix from $1,950 2026-05-13
Protobufjs HIGH 7.5
CVE-2026-44290

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to …

Fix: 7.5.6 / 8.0.2+
Fix from $1,950 2026-05-13
Protobufjs MEDIUM 5.3
CVE-2026-44288

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that a…

Fix: 7.5.6 / 8.0.2+
Fix from $1,600 2026-05-13
Protobufjs Cli HIGH 7.8
CVE-2026-42290

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input…

Fix: 1.2.1 / 2.0.2+
Fix from $1,950 2026-05-13
Protobufjs CRITICAL 9.8
CVE-2026-41242

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in…

Fix: 7.5.5+
Fix from $2,300 2026-04-18
Protobufjs CRITICAL 9.8
CVE-2023-36665

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-contr…

Fix: 7.2.5+
Fix from $2,300 2023-07-05
Protobufjs HIGH 7.5
CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototy…

Fix: 6.11.3+
Fix from $1,950 2022-05-27
Protobufjs MEDIUM 5.5
CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

Fix: after 6.8.5
Fix from $1,600 2018-06-07