protobufjs CVE-2026-44292

The application must pass an attacker-controlled plain object to a generated protobufjs message constructor (e.g., new GeneratedMessage(plainObject) or similar creation helper). The attacker-controlled object must contain an own enumerable __proto__ property, which is achievable via JSON.parse() of attacker-supplied JSON or via direct object literal construction. The application must rely on inherited properties, prototype methods, or prototype-based type checks (instanceof) on the resulting message instances for the prototype injection to cause observable impact. Applications that exclusively decode binary protobuf data (using methods that parse .proto binary format directly, not from plain objects) are not affected. Non-default configuration is not a limiting factor; the vulnerability exists in default message constructor behavior.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible unauthenticated exploitation with low attack complexity, but confidentiality and availability are not impacted-only integrity of the message instance prototype. EPSS score not provided. No CISA KEV status or public exploit code identified. Real-world risk is moderate but heavily dependent on application architecture: applications that only decode binary protobuf data from trusted sources face zero risk; applications accepting JSON input for message construction face elevated risk proportional to how downstream code relies on inherited properties, prototype methods, or instanceof checks on message objects. The per-instance scoping limits blast radius compared to global prototype pollution, but in frameworks or libraries that iterate over message instances and call inherited methods, exploitation could trigger unexpected behavior. The attack vector (network, no authentication, low complexity) and the requirement for attacker-controlled plain object input create a realistic attack surface in REST APIs or message brokers that accept JSON-to-protobuf conversion.

A web service accepts JSON input via REST API and constructs protobufjs message objects from parsed JSON using code like new MyMessage(JSON.parse(userInput)). An attacker sends a JSON payload with an injected __proto__ property containing a malicious object, e.g., {"field1": "value", "__proto__": {"toString": function(){return "pwned"}}}. The message constructor copies this __proto__ property onto the message instance, modifying its prototype chain. If downstream code calls toString() on the message or performs instanceof checks expecting the original prototype, the attacker's injected prototype is invoked instead.