CVE-2026-44293

HIGH 7.1

protobufjs: Code injection through bytes field defaults in generated toObject code

CVSS Score

7.1

EPSS Score

0.4%

EPSS Percentile

32th

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

CWE	CWE-94
Vendor	protobufjs
Product	protobuf.js
Published	May 13, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for protobufjs protobuf.js

Be the first to know when new high vulnerabilities affecting protobufjs protobuf.js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

protobufjs / protobuf.js

< 7.5.6 >= 8.0.0, < 8.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗