High severity · published May 13, 2026
CVE-2026-44290
protobufjs: Process-wide denial of service through unsafe option paths
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
protobuf.js · protobufjs
< 7.5.6; >= 8.0.0, < 8.0.2 · source: vendor
PR
Protobufjs · Protobufjs Project
before 7.5.6; 8.0.0 before 8.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44290
Mitigation
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg
More from protobuf.js
9.8
CVE-2026-41242
protobufjs has an arbitrary code execution issue
8.8
CVE-2026-44293
protobufjs: Code injection through bytes field defaults in generated toObject code
8.7
CVE-2026-44295
protobufjs-cli: Code injection in pbjs static output from crafted schema names
8.1
CVE-2026-44291
protobufjs: Code generation gadget after prototype pollution
7.8
CVE-2026-42290
protobufjs-cli: OS Command Injection