npm

protobufjs

View on npm registry
18 Total advisories
18 Vulnerabilities
0 Malware

Dependency scanning

Check whether protobufjs is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Vulnerabilities

HIGH 7.5
npm

CVE-2026-48712

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

MEDIUM 5.3
npm

CVE-2026-45740

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

HIGH 7.5
npm

CVE-2026-44290

protobuf.js: Process-wide denial of service through unsafe option paths

MEDIUM 5.3
npm

CVE-2026-44294

protobuf.js: Denial of service from crafted field names in generated code

MEDIUM 5.3
npm

CVE-2026-44288

protobufjs has overlong UTF-8 decoding

MEDIUM 5.3
npm

CVE-2026-54269

protobufjs : Schema-derived names can shadow runtime-significant properties

MEDIUM 5.3
npm

CVE-2026-54270

protobufjs: Memory amplification from preserved unknown fields in binary decode

MEDIUM 5.3
npm

CVE-2026-44292

protobuf.js: Prototype injection in generated message constructors

HIGH 8.1
npm

CVE-2026-44291

protobuf.js: Code generation gadget after prototype pollution

UNKNOWN
npm

CVE-2026-44293

protobuf.js: Code injection through bytes field defaults in generated toObject code

HIGH 7.5
npm

CVE-2026-44289

protobuf.js: Denial of service through unbounded protobuf recursion

CRITICAL 9.8
npm

CVE-2026-41242

Arbitrary code execution in protobufjs

MEDIUM 5.3
npm

CVE-2026-59877

protobufjs: Denial of Service via infinite loop in .proto option parsing

MEDIUM 4.8
npm

CVE-2026-59876

protobufjs: Text Format string map parsing can mutate returned map object prototype

CRITICAL 9.8
npm

CVE-2023-36665

protobufjs Prototype Pollution vulnerability

HIGH 7.5
npm

CVE-2022-25878

Prototype Pollution in protobufjs

MEDIUM 5.5
npm

CVE-2018-3738

Denial of Service in protobufjs

UNKNOWN
npm

GHSA-4gpv-cvmq-6526

Denial of Service in protobufjs

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Free, no credit card | First findings in minutes