8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44291

CVE-2026-44291: protobufjs: Code generation gadget after prototype pollution

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44291

CVE-2026-44291:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-75px-5xx7-5xc7, is a prototype pollution issue in protobuf.js. The root cause is the library's use of plain JavaScript objects ({}) as internal lookup tables and for data representation without proper safeguards. In JavaScript, when a property is accessed on an object, the runtime will traverse the prototype chain if the property is not found on the object itself. An attacker who can first achieve a prototype pollution primitive (i.e., add properties to Object.prototype) can exploit this behavior.

Several key functions in protobuf.js were vulnerable because they accessed properties on objects without checking if the property was its own or inherited. For example, functions like Namespace.get would look up a type name in a nested object. If the name wasn't found, JavaScript would look at Object.prototype, and if the attacker had polluted it with a property of the same name, the attacker's value would be returned and treated as a valid type definition.

This becomes critical in functions that dynamically generate JavaScript code, such as converter.fromObject and decoder. These functions build new functions as strings based on the structure of protobuf messages. By feeding a polluted reflection object into these code generators, an attacker could cause malicious strings to be written into the generated code, leading to arbitrary code execution when that code is later run.

The patches address this by:

Creating lookup tables with Object.create(null), which creates objects with no prototype, preventing them from being affected by Object.prototype pollution.
Using Object.prototype.hasOwnProperty.call(obj, key) to ensure that a property is owned by the object itself before using it.
Explicitly checking for and ignoring keys named __proto__, constructor, or prototype when iterating over keys from user-supplied objects or when creating new objects.

Vulnerable functions

Type.generateConstructor

src/type.js

The function generates a constructor for a message type. It iterates over keys from a plain object to populate the message's properties. Before the patch, it did not check for the `__proto__` property, allowing an attacker who could pollute the object's prototype to inject malicious properties into the constructed message object.

converter.fromObject

src/converter.js

This function generates code that converts a plain JavaScript object into a protobuf message. The generated code iterates over the keys of the input object. The vulnerability lies in the lack of validation for the `__proto__` key, which could allow an attacker to pollute the prototype of the resulting message object during the conversion process.

decoder

src/decoder.js

This function generates the decoder for a message type. When decoding a map field with string keys, it was vulnerable to a key named `__proto__`. An attacker could craft a malicious protobuf message that, when decoded, would pollute the prototype of the message object being constructed, leading to potential code execution gadgets.

Namespace.get

src/namespace.js

This function is used to look up reflection objects (like message types) by name. It used a plain object as a lookup cache. Before the patch, it did not use `hasOwnProperty`, making it vulnerable to prototype pollution. An attacker could pollute `Object.prototype` to make the `get` method return a malicious object, which could then be used in code generation, leading to arbitrary code execution.

util.merge

src/util/minimal.js

A utility function for merging properties from one object to another. It was vulnerable because it did not check for the `__proto__` property before copying, allowing for prototype pollution if the source object contained a `__proto__` key.

parse

src/parse.js

This function parses `.proto` files or JSON descriptors. When parsing options, it directly assigned properties to a result object. This was vulnerable to a property named `__proto__` in the source, which could pollute the prototype of the resulting reflection object.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.