Six Flaws in protobuf.js Turn Serialized Schemas Into Execution Vectors
The JavaScript Protocol Buffers library — pulled 50 million times a week — ships patches for a cluster of CVEs that let attackers use schema metadata to run arbitrary code inside Node.js processes.
Cyera researchers Assaf Morag and Vladimir Tokarev have disclosed six vulnerabilities in protobuf.js, a JavaScript implementation of Google's Protocol Buffers serialization format. The library sees more than 50 million weekly downloads and arrives in most projects silently, as a transitive dependency pulled in by gRPC tooling, Google Cloud client libraries, and similar frameworks.
The headline bug is CVE-2026-44291: a code-generation flaw rooted in how protobuf.js builds encoder and decoder functions at runtime using JavaScript's Function() constructor. An attacker who can influence schema-derived input can inject values that protobuf.js incorporates into that generated code and executes inside the live Node.js process. The researchers demonstrated a full chain where prototype pollution — tracked separately as CVE-2026-44292 — tricks the library into treating attacker-controlled values as legitimate protobuf types before those values reach the code-generation step.
A second remote code execution path exists in the pbjs command-line tool. CVE-2026-44295 allows crafted schema names to be embedded directly into generated JavaScript files, which then execute that content on import. This matters for CI/CD pipelines: a malicious schema introduced into a build workflow could execute inside a trusted build environment before any runtime protections apply.
The four remaining CVEs are lower severity. CVE-2026-44289, CVE-2026-44290, and CVE-2026-44294 cover denial-of-service conditions where malformed inputs can crash or exhaust application resources. CVE-2026-44292 covers the prototype injection primitive already mentioned.
Exploitation generally requires influence over protobuf schemas or descriptors. That precondition sounds narrow. It isn't — not in environments where schemas flow through APIs, cloud storage buckets, third-party integrations, and automated pipelines with little provenance checking.
Affected versions are protobuf.js 7.5.5 and earlier, plus 8.0.0 and 8.0.1. Patched releases are 7.5.6 and 8.0.2. The protobuf.js-cli tool requires a separate upgrade: version 1.2.1 (for the v1 branch) or 2.0.2.
What affected users should do. Run npm ls protobuf.js or npm ls protobufjs across your dependency trees — including sub-dependencies — to find every copy of the library in your stack. Upgrade all instances to 7.5.6 or 8.0.2 and update protobuf.js-cli to 1.2.1 or 2.0.2. If your CI/CD pipeline automatically processes .proto schema files sourced from external repositories or third-party integrations, treat those files as untrusted input and audit the pipeline for schema-injection paths before restarting automated builds.
