CVE-2026-44291: Prototype Pollution in protobufjs
Platform
nodejs
Component
protobufjs
CVE-2026-44291 affects versions of protobufjs up to 7.5.5. This vulnerability stems from the library's use of plain objects with inherited prototypes for internal type lookup tables. If an attacker can successfully pollute Object.prototype, they can manipulate these lookup tables, potentially leading to arbitrary JavaScript code execution during encoding or decoding operations.
Impact and Attack Scenarios
The core impact of CVE-2026-44291 lies in its potential for arbitrary JavaScript code execution. An attacker first needs to trigger a prototype pollution vulnerability, which could be achieved through various means depending on how protobufjs is integrated into the application. Once successful, the attacker can influence the generated JavaScript code used for encoding or decoding protobuf messages. This malicious code could then be executed within the application's context, granting the attacker a significant level of control. The blast radius is dependent on the application's privileges and the sensitivity of the data being processed by protobufjs. This vulnerability shares similarities with other prototype pollution attacks, highlighting the importance of secure object handling practices.
Exploitation Context
CVE-2026-44291 was published on 2026-05-12. Its severity is rated HIGH with a CVSS score of 8.1. Currently, there are no publicly known exploits or active campaigns targeting this vulnerability. The EPSS score is pending evaluation. Monitor security advisories and vulnerability databases for updates on exploitation activity.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- High — requires a race condition, non-default configuration, or specific circumstances. Harder to exploit reliably.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-44291 is to upgrade to a patched version of protobufjs. The vendor has not yet released a fixed version as of the publication date, so careful monitoring of the project's releases is crucial. As a temporary workaround, consider implementing strict object property validation to prevent prototype pollution at the application level. This could involve sanitizing input data before it's used to populate objects or employing libraries designed to prevent prototype pollution. WAF rules could be configured to detect and block requests containing suspicious prototype pollution payloads, although this is a less reliable defense. After upgrading, confirm the fix by attempting to trigger a protobuf encoding/decoding operation with a known malicious payload and verifying that it does not result in code execution.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Frequently asked questions
What is CVE-2026-44291 — Prototype Pollution in protobufjs?
CVE-2026-44291 is a HIGH severity vulnerability affecting protobufjs versions up to 7.5.5. It allows attackers to inject malicious code by polluting Object.prototype, potentially leading to arbitrary JavaScript code execution during encoding or decoding.
Am I affected by CVE-2026-44291 in protobufjs?
You are affected if you are using protobufjs version 7.5.5 or earlier. Check your project's dependencies to determine if you are using a vulnerable version.
How do I fix CVE-2026-44291 in protobufjs?
Upgrade to a patched version of protobufjs as soon as it becomes available. Until then, implement strict object property validation to prevent prototype pollution at the application level.
Is CVE-2026-44291 being actively exploited?
As of the publication date, there are no publicly known exploits or active campaigns targeting CVE-2026-44291. However, it's crucial to monitor for updates and potential exploitation attempts.
Where can I find the official protobufjs advisory for CVE-2026-44291?
Refer to the official protobufjs project's website and GitHub repository for updates and advisories related to CVE-2026-44291. Check the project's security page for announcements.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...