protobufjs CVE-2026-54269

Exploitation requires all three of the following conditions to be satisfied simultaneously: (1) The application must run an unpatched version of protobufjs (7.x at or below 7.6.2, or 8.x between 8.0.0 and 8.5.0) or protobufjs-cli (1.x at or below 1.3.2, or 2.x between 2.0.0 and 2.5.0). (2) The application must load or use a schema or protobufjs JSON descriptor containing at least one of three specific reserved names: a field named exactly hasOwnProperty, a field or oneof named $type accessed through the JSON or reflection descriptor loading path (not static code generation), or a service method whose generated helper name is rpcCall. (3) The application must invoke the precise API path associated with the shadowed name - verify, toObject, or required-field decode post-checks for hasOwnProperty; reflected message JSON serialization for $type; or RPC service invocation for rpcCall. Applications using only trusted, internally-controlled schemas that do not contain these names are not exploitable regardless of patch status. The CVSS PR:N rating means no authentication is required from the attacker's perspective when the application accepts schemas from network-accessible external sources, but this attack vector only applies when untrusted schema loading is part of the application's design.

The vendor-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately represents the worst-case network-accessible scenario where an application accepts untrusted schemas from external parties, but it overstates risk for the much more common deployment pattern of fully trusted, pre-compiled schemas. Real-world exploitability is gated behind three concurrent deployment conditions (unpatched version, schema containing a specific reserved name, and the application reaching the precise affected API path), which meaningfully narrows the practical attack surface beyond what the raw CVSS implies. No EPSS score was provided in the intelligence, so exploitation probability cannot be quantified. The vulnerability is not present in CISA KEV, and no public proof-of-concept exploit code has been identified, both of which indicate low current weaponization. The 'RCE' tag in the source metadata is erroneous and should be disregarded - the vendor advisory unambiguously states no code execution path is known. This is a genuine, addressable risk for multi-tenant or API-driven applications that dynamically load user-supplied or third-party protobuf schemas, but represents low operational urgency for applications operating exclusively with trusted, internally-controlled schemas.

An attacker operating against a multi-tenant gRPC gateway that accepts user-supplied .proto schema files submits a service definition containing a method whose generated protobufjs helper resolves to rpcCall. When the gateway loads this schema and a client invokes the service, the runtime's RPC dispatch reads the schema-derived method value instead of the internal rpcCall base helper, triggering uncontrolled recursion that exhausts the call stack and crashes the affected service worker. No public proof-of-concept exploit code has been identified, but the deterministic nature of the failure - reproducible whenever the specific API path is reached with an affected schema - makes this straightforward to trigger once an attacker understands the three affected name categories.