5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54270

CVE-2026-54270: protobufjs: Memory amplification from preserved unknown fields in binary decode

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54270

CVE-2026-54270:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	>= 8.2.0, <= 8.4.2	8.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the unconditional preservation of unknown fields during the binary decoding of protobuf messages, which can lead to excessive memory allocation and a potential denial of service. The analysis of the patch between the vulnerable version 8.4.2 and the patched version 8.5.0 pinpointed the exact code changes made to address this issue.

The core of the vulnerability is in the decoder function within src/decoder.js. This function dynamically generates the source code for a message's decode method. The patch shows that prior to the fix, the generated code would always execute logic to store unknown fields. The fix wraps this logic in a conditional block: if(!r.discardUnknown). This directly addresses the vulnerability by allowing the caller to control whether unknown fields are stored.

The Reader class in src/reader.js was also modified to add the discardUnknown property. This property serves as the flag that the decoder-generated function checks. While the Reader itself isn't the source of the memory allocation, it's a key component of the exploitation and mitigation path, as it carries the state that determines the decoder's behavior.

Therefore, any runtime profile of an exploitation attempt would involve a call to a message-specific decode method (e.g., MyMessage.decode), which is the function generated by the vulnerable decoder factory. The decoder function is identified as the primary vulnerable function because it is the source of the flawed logic.

Vulnerable functions

decoder

src/decoder.js

This function is a factory that generates the decoding logic for protobuf messages. In vulnerable versions, the generated code would always store unknown fields encountered in the binary stream into a `$unknowns` property on the decoded message object. This happens unconditionally, allowing an attacker to craft a message with many small, unknown fields, causing the decoder to allocate a large amount of memory to store them. This can lead to a denial-of-service through memory exhaustion. The patch introduces a conditional check for the `reader.discardUnknown` flag to allow skipping the storage of unknown fields.

Reader

src/reader.js

The `Reader` constructor is modified to include the `discardUnknown` property. While not directly vulnerable, this class is central to the vulnerability's mitigation. In vulnerable versions, the `Reader` had no mechanism to signal that unknown fields should be discarded, leading to the memory allocation issue in the decoder. The patch adds the `discardUnknown` property, which is then checked by the decoding logic generated by the `decoder` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.