Browse CVEs

HIGH 7.5 CVE-2026-59877 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing throug… Protobufjs 7.6.5 / 8.6.6+ Fix from $1,9502026-07-08 HIGH 8.2 CVE-2026-54271 protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-… Protobufjs Cli 1.3.2 / 2.5.0+ Fix from $1,9502026-06-22 MEDIUM 5.3 CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names t… Protobufjs 1.3.3 / 2.5.1+ Fix from $1,6002026-06-22 MEDIUM 5.3 CVE-2026-54270 protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$… Protobufjs 8.5.0+ Fix from $1,6002026-06-22 HIGH 7.5 CVE-2026-48712 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit whi… Protobufjs 7.6.1 / 8.4.1+ Fix from $1,9502026-06-22 HIGH 7.5 CVE-2026-45740 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit whi… Protobufjs 7.5.8 / 8.2.0+ Fix from $1,9502026-05-13 HIGH 8.8 CVE-2026-44293 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conve… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,9502026-05-13 HIGH 8.7 CVE-2026-44295 protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identif… Protobufjs Cli 1.2.1 / 2.0.2+ Fix from $1,9502026-05-13 MEDIUM 5.3 CVE-2026-44292 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied e… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,6002026-05-13 MEDIUM 5.3 CVE-2026-44294 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,6002026-05-13 HIGH 8.1 CVE-2026-44291 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited proto… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,9502026-05-13 HIGH 7.5 CVE-2026-44289 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit whi… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,9502026-05-13 HIGH 7.5 CVE-2026-44290 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to … Protobufjs 7.5.6 / 8.0.2+ Fix from $1,9502026-05-13 MEDIUM 5.3 CVE-2026-44288 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that a… Protobufjs 7.5.6 / 8.0.2+ Fix from $1,6002026-05-13 HIGH 7.8 CVE-2026-42290 protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input… Protobufjs Cli 1.2.1 / 2.0.2+ Fix from $1,9502026-05-13 CRITICAL 9.8 CVE-2026-41242 protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in… Protobufjs 7.5.5+ Fix from $2,3002026-04-18 CRITICAL 9.8 CVE-2023-36665 "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-contr… Protobufjs 7.2.5+ Fix from $2,3002023-07-05 HIGH 7.5 CVE-2022-25878 The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototy… Protobufjs 6.11.3+ Fix from $1,9502022-05-27 MEDIUM 5.5 CVE-2018-3738 protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Protobufjs after 6.8.5 Fix from $1,6002018-06-07