protobufjs CVE-2026-44288

The vulnerability requires all four of the following conditions to be met for meaningful impact: (1) the application must process protobuf binary data influenced or provided by an attacker, (2) the affected protobuf string field must be decoded through protobufjs's minimal UTF-8 decoder rather than a native UTF-8 decoder (this occurs in non-Node.js environments such as browsers, Cloudflare Workers, or other edge runtimes; Node.js applications typically use native Buffer decoding and are not affected), (3) the application must perform byte-level filtering or validation on the raw protobuf message before decoding (e.g., rejecting messages containing certain byte sequences), and (4) the decoded string must be used in a subsequent security-sensitive operation that depends on the byte-level filtering having been effective. Node.js applications using default Buffer-backed decoding paths are not vulnerable. Browser-based protobufjs deployments and edge-runtime environments that fall back to the minimal decoder are the primary targets.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates remote unauthenticated exploitation with low complexity, but integrity impact only (no confidentiality or availability loss). However, real-world risk is highly contextual and depends on three converging preconditions: (1) application decodes attacker-controlled protobuf data, (2) decoding uses protobufjs's minimal decoder rather than Node's native path, and (3) the application performs byte-level validation before decoding and then uses the decoded string in a security-sensitive check. This is a validation bypass vulnerability, not a direct remote code execution or denial-of-service vector. The low CVSS reflects the integrity impact alone; practical exploitation requires downstream application logic that falsely assumes byte-level filtering provides security guarantees post-decoding. Applications using Node.js Buffer-backed paths (standard in Node.js environments) are not affected, narrowing the exposed surface to browser-based and edge-runtime protobufjs instances.

An attacker sends a protobuf message with a string field encoded using overlong UTF-8 sequences. For example, the letter 'A' (ASCII 0x41) could be encoded as the overlong sequence 0xC0 0x81 instead of its valid single-byte form 0x41. An application that filters raw protobuf bytes for forbidden characters (e.g., rejecting messages containing 0x41) would pass the malicious message through. When protobufjs decodes the string using the minimal UTF-8 decoder, it canonicalizes the overlong sequence to 'A', resulting in a string that bypassed the application's byte-level filter. The application then uses this bypassed string in a security decision (e.g., accepting it as a safe username or command), leading to validation bypass.