CVE-2026-44290: DoS in protobufjs ≤7.5.5

The core of this vulnerability lies in protobufjs's option handling mechanism. When processing protobuf schemas or JSON descriptors, the parser incorrectly traverses inherited object properties. A malicious actor can craft a schema or descriptor that exploits this flaw, causing the parser to write to properties on global JavaScript constructors, such as Object, Array, or String. This corruption effectively breaks the fundamental building blocks of the JavaScript runtime, leading to unpredictable behavior and application crashes. The impact is persistent; the corruption remains until the process is restarted, resulting in a prolonged denial of service. This differs from transient DoS attacks as it requires no ongoing exploitation.

1. Publiée2026-05-12

The primary mitigation for CVE-2026-44290 is to upgrade to a patched version of protobufjs. While a specific fixed version is not yet available, monitoring the project's release notes is crucial. In the interim, implement strict schema validation to prevent the parsing of untrusted or potentially malicious protobuf schemas and JSON descriptors. This can involve whitelisting allowed schema structures or using a schema validation library. Consider implementing a Web Application Firewall (WAF) or proxy to inspect and filter incoming protobuf data, blocking requests containing suspicious schema constructs. Carefully review any third-party libraries or components that utilize protobufjs and ensure they are not vulnerable to this issue.