5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44294

CVE-2026-44294: protobufjs: Denial of service from crafted field names in generated code

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44294

CVE-2026-44294:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-44294, is a Denial of Service issue in protobuf.js caused by improper input validation of field names from protobuf schemas. When protobuf.js generates Javascript code for operations like encode, decode, or verify, it uses names from the schema to create identifiers (function names and properties) in the generated code. The vulnerability lies in the fact that these names were not properly sanitized.

My analysis of the provided patch 69b6aed1b46d4f7d069cbea7d3aecbf4831f295d reveals that the fix was concentrated in the code generation and utility functions responsible for handling these names. An attacker could provide a specially crafted schema with control characters in field or message names. This would cause the code generation process to produce syntactically invalid Javascript. When the application attempts to use the affected message type for the first time (e.g., by calling decode), the invalid code would be evaluated, throwing a SyntaxError and crashing the process, leading to a Denial of Service.

The three functions identified are central to the vulnerability and its fix:

codegen: This is the core function for generating dynamic methods. It was vulnerable to crafted message names used as function names. The patch adds the safeFunctionName helper to sanitize these names.
util.safeProp: This utility is used to generate property accessors from field names. The original escaping was insufficient. The fix replaces it with the more robust JSON.stringify.
escapeName: This function serves the same purpose as the others but for the static code generation part of the CLI. It was also hardened to strip malicious characters.

By identifying these functions, a security engineer can understand that any runtime profile showing calls into protobuf.js's code generation logic (which happens lazily on the first use of a message type) could be an indicator of an attempt to exploit this vulnerability if the application loads untrusted schemas.

Vulnerable functions

codegen

lib/codegen/index.js

The `codegen` function is used to dynamically generate other functions (`decode`, `encode`, `verify`, etc.) for protobuf message types. It constructs the function as a string. The function name was taken from the protobuf schema (`mtype.name`) and used directly in the generated code without proper sanitization. An attacker could provide a schema with a field name containing control characters, which would result in a `SyntaxError` when the generated function string is evaluated. The patch introduces a `safeFunctionName` function that sanitizes the name by removing invalid characters, thus preventing the syntax error.

util.safeProp

src/util.js

The `util.safeProp` function is a utility used throughout the code generation process to create safe property accessors for field names. The original implementation used regular expressions to escape characters, which was insufficient. A crafted field name from a malicious schema could bypass this escaping and inject characters that would break the generated Javascript code, leading to a `SyntaxError` and a Denial of Service. The patch replaces the custom escaping logic with `JSON.stringify(prop)`, which is a much more robust and secure way to ensure the property name is treated as a literal string.

escapeName

cli/targets/static.js

The `escapeName` function is used by the `pbjs` command-line tool when generating static Javascript code from protobuf schemas. Similar to the runtime code generation, this function was vulnerable because it did not properly sanitize names from the schema. A crafted field name could be embedded in the static output file, causing syntax errors. The patch hardens this function by stripping all non-word characters, ensuring any generated identifiers are valid and safe.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.