{"id":"CVE-2023-36665","aliases":["CLSA-2026-1784164061","CLSA-2026-1792184156","EUVD-2023-2072","GHSA-h755-8qp9-cq85","ROOT-APP-NPM-CVE-2023-36665"],"status":"published","title":"protobufjs Prototype Pollution vulnerability","description":"\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01697,"percentile":0.77324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-07-05T00:00:00Z","modified":"2026-10-30T19:45:57Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["6.11.4","7.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["6.11.2-aikido.1","7.2.0-aikido.1","7.2.0-aikido.2","7.2.0-aikido.3","6.11.4-aikido.2","6.11.4-aikido.3","6.11.4-aikido.4","6.11.4-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["6.11.2-root.io.1","7.2.0-root.io.1","7.2.0-root.io.2","7.2.0-root.io.3","6.11.4-root.io.1","6.11.4-root.io.2","6.11.4-root.io.3","6.11.4-root.io.4","6.11.4-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.0"},{"fixed":"6.11.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.2-tuxcare.0"},{"fixed":"6.10.2-tuxcare.1"}]}],"versions":["6.10.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.2"}]}],"versions":["6.11.3","6.11.3-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.10.0"},{"fixed":"6.11.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-aikido.1"},{"fixed":"7.2.0-aikido.1"},{"fixed":"7.2.0-aikido.2"},{"fixed":"7.2.0-aikido.3"},{"fixed":"6.11.4-aikido.2"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.4-aikido.4"},{"fixed":"6.11.4-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-root.io.1"},{"fixed":"7.2.0-root.io.1"},{"fixed":"7.2.0-root.io.2"},{"fixed":"7.2.0-root.io.3"},{"fixed":"6.11.4-root.io.1"},{"fixed":"6.11.4-root.io.2"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.4-root.io.4"},{"fixed":"6.11.4-root.io.5"}]}]}],"products":[{"vendor":"protobufjs_project","product":"protobufjs"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4","tags":["x_transferred","Patch","web"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d","tags":["x_transferred","Patch","fix","web"]},{"url":"https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665","tags":["x_transferred","Exploit","Patch","Third Party Advisory","article","web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/1899","tags":["x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240628-0006/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36665","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commits/release-6.11.4","tags":["web"]},{"url":"https://github.com/protobufjs/protobuf.js/issues/1918#issuecomment-1723500294","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240628-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h755-8qp9-cq85"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36665.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-36665","description":"\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.","status":"published","published":"2023-07-05T00:00:00Z","modified":"2024-08-02T16:52:54.371Z","updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-2072","description":"\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.","status":"published","published":"2023-07-05T00:00:00Z","modified":"2024-08-02T16:52:54Z","updated_at":"2026-11-03T03:50:03.761294Z"}],"ghsa":[{"id":"GHSA-h755-8qp9-cq85","title":"protobufjs Prototype Pollution vulnerability","description":"protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about `Object.constructor.prototype.\u003cnew-property\u003e = ...;` whereas CVE-2022-25878 was about `Object.__proto__.\u003cnew-property\u003e = ...;` instead.","status":"published","published":"2023-07-05T15:30:24Z","modified":"2024-06-28T18:31:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2023-36665","description":"\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.","status":"published","published":"2023-07-05T14:15:09.41Z","modified":"2026-06-17T06:06:47.433Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:08:14.715708Z"}],"osv":[{"id":"GHSA-h755-8qp9-cq85","title":"protobufjs Prototype Pollution vulnerability","description":"protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about `Object.constructor.prototype.\u003cnew-property\u003e = ...;` whereas CVE-2022-25878 was about `Object.__proto__.\u003cnew-property\u003e = ...;` instead.","status":"published","published":"2023-07-05T15:30:24Z","modified":"2026-08-07T08:12:13.849928168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"CLSA-2026-1784164061","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-30T19:45:57.267311183Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1792184156","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.","status":"published","published":"2026-10-16T20:55:56Z","modified":"2026-10-17T01:30:06.508288094Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CVE-2023-36665","description":"\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.","status":"published","published":"2023-07-05T00:00:00Z","modified":"2026-10-28T02:31:12.323417585Z","updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"ROOT-APP-NPM-CVE-2023-36665","title":"CVE-2023-36665 in protobufjs - Patched by Root","description":"Root has patched CVE-2023-36665 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-25T09:09:30Z","modified":"2026-09-25T10:15:04.972881313Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}