CVE-2026-44295: Code Injection in protobuf.js 2.x
Platform
nodejs
Component
protobufjs
Fixed in
2.0.2
CVE-2026-44295 affects versions 2.0.0 through 2.0.1 of protobuf.js, a JavaScript library for encoding and decoding data structures. This vulnerability allows an attacker to inject malicious JavaScript code by crafting a malicious schema or JSON descriptor. The vulnerability is fixed in version 2.0.2 and users are strongly advised to upgrade immediately to prevent potential code execution.
Impact and Attack Scenarios
The core of this vulnerability lies in the static code generation process within protobuf.js. When generating JavaScript code from a protobuf schema, the library fails to adequately sanitize names used for namespaces, enums, services, and derived types. An attacker can craft a malicious schema containing specially crafted names that, when processed by pbjs, result in the generation of JavaScript code containing arbitrary commands. This injected code could then be executed within the context of the application using protobuf.js, potentially leading to complete compromise of the system. The blast radius extends to any application relying on this library for data serialization, particularly those handling untrusted input.
Exploitation Context
This vulnerability was published on 2026-05-13. Currently, there are no publicly available exploits or active campaigns targeting this vulnerability. Its severity is rated HIGH (CVSS: 8.7), indicating a significant risk. The vulnerability is not currently listed on KEV or EPSS, suggesting a low to medium probability of exploitation in the near term, but proactive patching is still highly recommended.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation is to upgrade to protobuf.js version 2.0.2 or later, which includes the necessary sanitization fixes. If upgrading is not immediately feasible, consider implementing input validation on protobuf schemas before processing them with pbjs. This could involve whitelisting allowed characters or patterns in names. As a temporary workaround, consider using a Web Application Firewall (WAF) to filter requests containing potentially malicious protobuf schemas. While not a complete solution, it can provide an additional layer of defense. After upgrading, confirm the fix by generating code from a known malicious schema and verifying that the generated JavaScript does not contain the injected code.
How to fix
Actualice la biblioteca protobuf.js a la versión 2.0.2 o superior, o a la versión 1.2.1 o superior si está utilizando una versión anterior a 2.0.0. Esto solucionará la vulnerabilidad de inyección de código al sanear correctamente los nombres de los esquemas.
Frequently asked questions
What is CVE-2026-44295 — Code Injection in protobuf.js?
CVE-2026-44295 is a HIGH severity vulnerability in protobuf.js versions 2.0.0–2.0.1 that allows attackers to inject malicious JavaScript code through crafted protobuf schemas, potentially leading to code execution.
Am I affected by CVE-2026-44295 in protobuf.js?
You are affected if you are using protobuf.js versions 2.0.0 through 2.0.1. Check your project dependencies to determine if you are using a vulnerable version.
How do I fix CVE-2026-44295 in protobuf.js?
Upgrade to protobuf.js version 2.0.2 or later to resolve this vulnerability. If upgrading is not immediately possible, implement input validation on protobuf schemas.
Is CVE-2026-44295 being actively exploited?
Currently, there are no publicly known exploits or active campaigns targeting CVE-2026-44295, but proactive patching is still recommended due to its HIGH severity.
Where can I find the official protobuf.js advisory for CVE-2026-44295?
Refer to the official protobuf.js GitHub repository for updates and advisories: https://github.com/protocolbuffers/protobufjs
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...