CVE-2026-44291: Prototype Pollution in protobufjs

The core impact of CVE-2026-44291 lies in its potential for arbitrary JavaScript code execution. An attacker first needs to trigger a prototype pollution vulnerability, which could be achieved through various means depending on how protobufjs is integrated into the application. Once successful, the attacker can influence the generated JavaScript code used for encoding or decoding protobuf messages. This malicious code could then be executed within the application's context, granting the attacker a significant level of control. The blast radius is dependent on the application's privileges and the sensitivity of the data being processed by protobufjs. This vulnerability shares similarities with other prototype pollution attacks, highlighting the importance of secure object handling practices.

1. 公開日2026-05-12

The primary mitigation for CVE-2026-44291 is to upgrade to a patched version of protobufjs. The vendor has not yet released a fixed version as of the publication date, so careful monitoring of the project's releases is crucial. As a temporary workaround, consider implementing strict object property validation to prevent prototype pollution at the application level. This could involve sanitizing input data before it's used to populate objects or employing libraries designed to prevent prototype pollution. WAF rules could be configured to detect and block requests containing suspicious prototype pollution payloads, although this is a less reliable defense. After upgrading, confirm the fix by attempting to trigger a protobuf encoding/decoding operation with a known malicious payload and verifying that it does not result in code execution.