protobuf.js: Denial of service from crafted field names in generated code
Summary
protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation.
Impact
An attacker who can provide or influence a protobuf schema or JSON descriptor may be able to make affected message types unusable by causing protobufjs runtime code generation to throw a syntax error.
This is a denial of service issue for applications that load untrusted schemas or descriptors. Applications that only use trusted, application-defined schemas are not directly affected by this issue.
The issue is not known to allow code execution by itself.
Preconditions
- The application must allow an attacker to control or influence a protobuf schema or JSON descriptor.
- The crafted input must define a field name containing control characters that reach generated JavaScript property access.
- The application must perform an operation that triggers protobufjs code generation for the affected type, such as encode, decode, verify,
fromObject, ortoObject.
Workarounds
Do not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate field names before loading them and reject names containing control characters.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | protobufjs | < 7.5.6, >= 8.0.0, < 8.0.2 | 7.5.6, 8.0.2 |
References
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3
- https://nvd.nist.gov/vuln/detail/CVE-2026-44294
- https://github.com/protobufjs/protobuf.js
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-20- Platform
- npm
- Package
protobufjs- Disclosed
- 12.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2pr8-phx7-x9h3 - CC BY 4.0
Vulnerability history: protobufjs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 17
- First → latest
- 10.2018 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 6
- Medium 9
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 14
-
protobuf.js: Denial of service from crafted field names in generated code this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.