protobufjs_project has 4 CVEs on record. 1 was published in the last 90 days. The median CVSS is 8.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 1 prev 3
Weakness classes
Products
- protobufjs 4
Worst active — by depth score
CVE-2026-41242Critical· 9.8protobufjs compiles protobuf definitions into JavaScript (JS) functions66CVE-2026-44293High· 8.8protobufjs compiles protobuf definitions into JavaScript (JS) functions48CVE-2026-44289High· 7.5protobufjs compiles protobuf definitions into JavaScript (JS) functions41CVE-2026-59876Medium· 4.8protobufjs compiles protobuf definitions into JavaScript (JS) functions26
protobufjs_project vulnerabilities
CVEs affecting protobufjs_project, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-59876Medium· 4.8protobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __pro…
CVE-2026-44293High· 8.8protobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field de…
CVE-2026-44289High· 7.5protobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and g…
CVE-2026-41242Critical· 9.8PoCprotobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decodi…