7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44290

CVE-2026-44290: protobufjs: Process-wide denial of service through unsafe option paths

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44290

CVE-2026-44290:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of prototype pollution in the protobuf.js library. An attacker who can control the protobuf schema or a JSON descriptor can inject properties into Object.prototype. This is a serious vulnerability that can lead to a process-wide denial of service, and potentially other security issues depending on the application's logic.

The root cause is insufficient sanitization of property names when processing untrusted schemas and data. The library failed to block property names like __proto__, constructor, and prototype in several key areas:

Schema Parsing: The parse function and the ReflectionObject.setOption method allowed options with malicious names, which were then set using the vulnerable util.setProperty utility. This allowed an attacker to write to arbitrary paths on an object, eventually reaching the global Object.prototype.
Data Conversion: The Type.fromObject method did not safely handle input objects with a __proto__ key, allowing for direct prototype pollution of message instances.
Binary Deserialization: The Type.decode method did not safely handle map fields with a string key of __proto__, allowing a crafted binary payload to pollute the prototype of a message instance.

The patches address these issues by adding explicit checks to disallow or safely handle these special property names across all identified vulnerable code paths, effectively preventing the prototype pollution.

Vulnerable functions

parse

src/parse.js

The `parse` function, when processing options within a protobuf schema, was vulnerable to prototype pollution. An attacker could craft a schema with an option named `__proto__` to modify the `Object.prototype`. This could lead to a denial of service or other unexpected behavior throughout the application. The patch prevents assignment if the property name is `__proto__`.

ReflectionObject.setOption

src/object.js

The `setOption` method on `ReflectionObject` is used to set options on schema elements like messages, fields, and enums. It was vulnerable to prototype pollution because it did not properly sanitize the option `name`. An attacker could provide `__proto__` as the option name to modify the object's prototype. The patch adds a check to explicitly disallow `__proto__` as an option name.

util.setProperty

src/util.js

This utility function, used by `setOption` to set nested properties, had an insufficient check for unsafe property names. A crafted option path (e.g., `(my_option).constructor.prototype.polluted`) could bypass the check and pollute the prototype of global objects. The patch introduces a more robust regular expression (`unsafePropertyRe`) to block any attempts to modify `__proto__`, `prototype`, or `constructor`.

Type.fromObject

src/converter.js

The `fromObject` method, which converts a plain JavaScript object into a message instance, was vulnerable to prototype pollution. If the input object contained a key named `__proto__`, it could modify the prototype of the newly created message object. The patch, applied in the code generator (`converter.js`), adds a check to treat `__proto__` as a regular property, preventing the pollution.

Type.decode

src/decoder.js

The `decode` method was vulnerable to prototype pollution when deserializing a message with a map field that has string keys. A crafted binary message could contain a map key named `__proto__`, which would lead to the modification of the message object's prototype during decoding. The patch, applied in the code generator (`decoder.js`), adds a check to handle this case safely.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.