protobufjs CVE-2026-44294

The application must explicitly load a protobuf schema or JSON descriptor from a source that an attacker can influence or control. This includes remote sources (API responses, user-uploaded files, external configuration services), local files if writable by untrusted processes, or in-memory schema objects constructed from untrusted input. The crafted schema must contain at least one field name or oneof name with one or more control characters (Unicode categories Cc: Other, Control, such as U+000A line feed, U+0009 tab, U+000D carriage return, U+000C form feed, or other non-printing characters). The application must then trigger code generation by calling an operation on a message of the affected type: calling .encode(), .decode(), .verify(), .fromObject(), .toObject(), or similar methods, or accessing the message constructor. If the application only loads and uses hardcoded, application-defined schemas built into the binary or configuration files not writable by attackers, this vulnerability does not apply. The attack vector is remote (AV:N) only in the sense that schema injection can originate over the network; however, local schema file injection or in-process message object injection by other processes/code paths also satisfies the preconditions.

This vulnerability presents moderate real-world risk with important caveats. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects a network-accessible denial of service with low attack complexity and no authentication required-however, the severity is inherently limited because the impact is availability only (A:L), not confidentiality or integrity. Exploitation probability is straightforward: any attacker who can inject or influence a schema definition can trigger the denial of service. The real-world risk depends entirely on deployment context. Applications accepting schemas from untrusted sources (e.g., user uploads, third-party APIs, config files) face significant risk; those using only hardcoded, application-defined schemas face none. The CVSS vector and preconditions align: network vector is accurate because schema injection can occur remotely (via API, file upload, etc.), and AC:L reflects that once a malicious schema is loaded, the denial of service is guaranteed. No special exploitation conditions exist-the attack surface is the schema loading mechanism itself. No public exploit code has been identified beyond the proof-of-concept implicit in the vulnerability description (a field name with a newline character). This is not an 'in the wild' exploitation risk but rather a supply-chain or API security risk for applications that do not validate untrusted schemas.

An attacker hosting a malicious gRPC service or API endpoint provides a crafted protobuf schema or JSON descriptor where a message field is named with a newline character (e.g., 'fieldName injected'). When a client application using protobufjs loads this schema via fetch, API call, or config file and then attempts to serialize or deserialize a message of that type, the code generation phase fails with a SyntaxError, causing the application to crash or become unable to communicate with the endpoint. No code execution occurs, but the availability impact is complete: the affected message type becomes unusable for the lifetime of the application process.