protobufjs CVE-2026-44290

Exploitation requires three specific preconditions from the vendor advisory: (1) Application accepts attacker-controlled or attacker-influenced protobuf schema files (.proto) or JSON descriptors-not just protobuf message payloads; this is the critical limiting factor distinguishing vulnerable deployments from the majority using static schemas; (2) Application parses these schemas using protobufjs reflection APIs: parse(), Root.load(), Root.loadSync(), or Root.fromJSON()-compiled/generated message classes are not vulnerable; (3) Crafted schema includes option paths with unsafe property traversal like __proto__ or constructor.prototype that reach inherited object properties during option processing. Applications using bundled, version-controlled, or otherwise trusted schemas to decode untrusted protobuf message payloads are explicitly NOT affected per vendor advisory. Exploitation is limited to: developer tools, API gateways with dynamic schema loading, schema registries, protobuf validation services, or applications with file upload features accepting .proto files.

Real-world risk requires careful contextualization beyond the CVSS 7.5 score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible remote exploitation without authentication, which appears severe. However, exploitation requires the application to parse attacker-controlled schemas or JSON descriptors-a significantly narrower attack surface than parsing untrusted message payloads. Most production applications use pre-compiled or bundled schemas and only parse untrusted binary messages, making them immune to this vulnerability per the vendor advisory. The impact is limited to persistent denial of service through state corruption; the vendor explicitly states the issue is not known to allow code execution despite the RCE tag. No CISA KEV listing and no public exploit code at time of analysis suggest this has not been widely weaponized. EPSS data not provided, but the specific preconditions (schema control, not just message control) likely result in lower real-world exploitation probability than the raw CVSS suggests. Priority should focus on applications with dynamic schema loading from external or user-provided sources (API gateways, schema registries, dev tools). Applications using static schemas for message decoding can deprioritize.

An attacker identifies a web application that accepts user-uploaded protobuf schema files for dynamic message validation or a gRPC API gateway that loads service definitions from a public schema registry. The attacker crafts a malicious .proto file or JSON descriptor containing an option path like 'constructor.prototype.isAdmin' set to true. When the application parses this schema via Root.loadSync(), protobufjs writes to Object.prototype.isAdmin, injecting this property into all JavaScript objects process-wide. Subsequent application code checking if (user.isAdmin) now always evaluates to true for all users, or protobufjs internal operations fail due to corrupted built-ins, causing persistent denial of service until the Node.js process restarts. The attacker achieves sustained disruption or privilege escalation through corrupted global state, not direct code execution.