5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44288

CVE-2026-44288: protobufjs: Overlong UTF-8 decoding

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44288

CVE-2026-44288:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2
@protobufjs/utf8	npm	<= 1.1.0	1.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'overlong UTF-8 decoding', is located in the minimal UTF-8 decoder within the protobufjs library, specifically in the @protobufjs/utf8 package. Analysis of the security patch 75392ea1b78bdc4faba027b5db44ad7c50e9c454 reveals that the core of the vulnerability lies in the utf8.read function in lib/utf8/index.js. Before the patch, this function would decode non-canonical, overlong UTF-8 byte sequences into characters. This could lead to bypasses of security filters that inspect raw byte data before it is converted to a string. For example, a byte sequence that does not contain an ASCII slash / could be decoded into a string that does. The patch rectifies this by adding validation to detect and reject these overlong sequences, replacing them with the standard Unicode replacement character \ufffd. The new test cases added in lib/utf8/tests/index.js explicitly check for this corrected behavior with known overlong sequences, confirming that utf8.read is the affected function.

Vulnerable functions

utf8.read

lib/utf8/index.js

The `utf8.read` function in the `@protobufjs/utf8` package is responsible for decoding UTF-8 byte sequences. The vulnerable version of this function improperly handled overlong UTF-8 sequences, decoding them into their canonical character representations instead of rejecting them. This could allow an attacker to bypass byte-level security checks by crafting protobuf messages with seemingly innocuous byte patterns that decode into malicious strings. The patch introduces strict checks to ensure that decoded characters are represented by their shortest possible byte sequence and fall within the valid Unicode range, replacing any invalid sequences with the Unicode replacement character (U+FFFD).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.