{"id":"CVE-2026-44292","aliases":["CLSA-2026-1784250508","CLSA-2026-1785468075","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1791362263","CLSA-2026-1792184156","CLSA-2026-1792490720","CLSA-2026-1792755967","EUVD-2026-30030","GHSA-fx83-v9x8-x52w","ROOT-APP-NPM-CVE-2026-44292"],"status":"published","title":"protobufjs: Prototype injection in generated message constructors","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00264,"percentile":0.18458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-05-12T15:01:44Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["7.5.6","8.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["7.5.5-aikido.4","7.5.4-aikido.5","8.0.1-aikido.5","7.4.0-aikido.4","8.0.1-aikido.6","7.5.4-aikido.6","7.4.0-aikido.5","7.4.0-aikido.6","6.11.4-aikido.3","6.11.6-aikido.3","6.11.6-aikido.4","6.11.4-aikido.4","6.11.6-aikido.5","7.5.5-aikido.5","8.0.1-aikido.7","7.5.4-aikido.7","7.4.0-aikido.7","7.5.5-aikido.6","8.0.1-aikido.8","7.5.4-aikido.8","6.11.4-aikido.5","7.5.5-aikido.7","8.0.1-aikido.9","6.11.6-aikido.6","7.5.5-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["7.5.5-root.io.4","7.5.4-root.io.5","8.0.1-root.io.5","7.4.0-root.io.4","8.0.1-root.io.6","7.5.4-root.io.6","7.4.0-root.io.5","7.4.0-root.io.6","6.11.4-root.io.3","6.11.6-root.io.3","6.11.6-root.io.4","6.11.4-root.io.4","6.11.6-root.io.5","7.5.5-root.io.5","8.0.1-root.io.7","7.5.4-root.io.7","7.4.0-root.io.7","7.5.5-root.io.6","8.0.1-root.io.8","7.5.4-root.io.8","6.11.4-root.io.5","7.5.5-root.io.7","8.0.1-root.io.9","6.11.6-root.io.6","7.5.5-root.io.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.5"},{"fixed":"7.5.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.1"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.4"}]}],"versions":["6.11.6","6.11.6-tuxcare.1","6.11.6-tuxcare.2","6.11.6-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.1-tuxcare.0"},{"fixed":"8.0.1-tuxcare.1"}]}],"versions":["8.0.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.2"}]}],"versions":["6.11.3","6.11.3-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.3"}]}],"versions":["7.5.4","7.5.4-tuxcare.1","7.5.4-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.6"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.5-aikido.4"},{"fixed":"7.5.4-aikido.5"},{"fixed":"8.0.1-aikido.5"},{"fixed":"7.4.0-aikido.4"},{"fixed":"8.0.1-aikido.6"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.5"},{"fixed":"7.4.0-aikido.6"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.6-aikido.3"},{"fixed":"6.11.6-aikido.4"},{"fixed":"6.11.4-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.1-aikido.8"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"7.5.5-aikido.7"},{"fixed":"8.0.1-aikido.9"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.5-root.io.4"},{"fixed":"7.5.4-root.io.5"},{"fixed":"8.0.1-root.io.5"},{"fixed":"7.4.0-root.io.4"},{"fixed":"8.0.1-root.io.6"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.5"},{"fixed":"7.4.0-root.io.6"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.6-root.io.3"},{"fixed":"6.11.6-root.io.4"},{"fixed":"6.11.4-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.1-root.io.8"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"7.5.5-root.io.7"},{"fixed":"8.0.1-root.io.9"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","tags":["web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44292","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fx83-v9x8-x52w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44292.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44292","title":"protobufjs: Prototype injection in generated message constructors","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:42:55.155Z","modified":"2026-05-18T14:01:31.297Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30030","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:42:55Z","modified":"2026-05-18T14:01:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:16.642345Z"}],"ghsa":[{"id":"GHSA-fx83-v9x8-x52w","title":"protobuf.js: Prototype injection in generated message constructors","description":"## Summary\n\nprotobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the `__proto__` key. If an application constructed a message from an attacker-controlled plain object, an own enumerable `__proto__` property could alter the prototype of that individual message instance.\n\n## Impact\n\nAn attacker who can control the properties object passed to a generated protobufjs message constructor or creation helper may be able to modify the prototype chain of the resulting message instance.\n\nThis is a per-instance prototype injection issue. It does not pollute `Object.prototype` or other global prototypes. The impact depends on downstream application behavior, such as relying on inherited properties, prototype methods, or `instanceof` checks for message objects.\n\nApplications that only decode binary protobuf data, or that construct messages from trusted application-defined objects, are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a plain object used to construct a protobufjs message.\n- The object must contain an own enumerable `__proto__` property, for example from parsed JSON input.\n- The application must pass that object to a generated message constructor or creation helper that copies arbitrary enumerable properties.\n\n## Workarounds\n\nDo not pass attacker-controlled plain objects directly to generated message constructors with affected versions. If untrusted JSON input must be accepted, validate or sanitize object keys before constructing messages, and reject `__proto__` properties.","status":"published","published":"2026-05-12T15:01:44Z","modified":"2026-05-14T20:35:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44292","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T16:16:56.123Z","modified":"2026-11-11T20:10:00.273Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-11T21:26:15.366289Z"}],"osv":[{"id":"CVE-2026-44292","title":"protobufjs: Prototype injection in generated message constructors","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:42:55.155Z","modified":"2026-10-28T02:30:57.207597018Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-fx83-v9x8-x52w","title":"protobuf.js: Prototype injection in generated message constructors","description":"## Summary\n\nprotobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the `__proto__` key. If an application constructed a message from an attacker-controlled plain object, an own enumerable `__proto__` property could alter the prototype of that individual message instance.\n\n## Impact\n\nAn attacker who can control the properties object passed to a generated protobufjs message constructor or creation helper may be able to modify the prototype chain of the resulting message instance.\n\nThis is a per-instance prototype injection issue. It does not pollute `Object.prototype` or other global prototypes. The impact depends on downstream application behavior, such as relying on inherited properties, prototype methods, or `instanceof` checks for message objects.\n\nApplications that only decode binary protobuf data, or that construct messages from trusted application-defined objects, are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a plain object used to construct a protobufjs message.\n- The object must contain an own enumerable `__proto__` property, for example from parsed JSON input.\n- The application must pass that object to a generated message constructor or creation helper that copies arbitrary enumerable properties.\n\n## Workarounds\n\nDo not pass attacker-controlled plain objects directly to generated message constructors with affected versions. If untrusted JSON input must be accepted, validate or sanitize object keys before constructing messages, and reject `__proto__` properties.","status":"published","published":"2026-05-12T15:01:44Z","modified":"2026-09-10T03:50:46.90666969Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"ROOT-APP-NPM-CVE-2026-44292","title":"CVE-2026-44292 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-44292 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:04.915981642Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1784250508","title":"TuxCare security update for protobufjs (6 CVEs)","description":"TuxCare rebuilt protobufjs to address 6 CVEs. Fixed in 6.11.6-tuxcare.4.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:36.23843937Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791362263","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.","status":"published","published":"2026-10-07T08:37:43Z","modified":"2026-10-15T09:47:58.388325645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792184156","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.","status":"published","published":"2026-10-16T20:55:56Z","modified":"2026-10-17T01:30:06.508288094Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792755967","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 7.5.4-tuxcare.3.","status":"published","published":"2026-10-23T11:46:07Z","modified":"2026-10-23T13:45:35.143131593Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}