protobuf.js CVE-2026-59876

Exploitation requires all of the following conditions simultaneously: (1) the application must explicitly import and use the non-default protobufjs/ext/textformat module - the standard binary protobuf encoding path is not affected; (2) the application must pass attacker-controlled data as input to the text-format parser; (3) the protobuf schema used must define one or more map fields with string keys, enabling the __proto__ key to be reached during parsing; and (4) downstream application code must act on the returned map object in a way that is sensitive to prototype chain modifications (e.g., iterating with for...in, checking for inherited properties, or passing the object to code that uses prototype-inherited values). The CVSS AC:H metric reflects this multi-condition requirement. What limits exploitation: the text-format extension is not imported by default and must be deliberately chosen; the vulnerable code path is isolated to map-key handling in that single extension; and meaningful impact requires prototype-pollution-susceptible downstream patterns that are not universal. Affected versions are strictly 8.2.0-8.6.4 - deployments on earlier or patched releases are not exposed.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8 Medium) is well-calibrated for this vulnerability. The network attack vector reflects that applications receiving protobuf text-format data over the network can be targeted remotely. High attack complexity (AC:H) is appropriate and significant: exploitation requires the target application to have explicitly imported and deployed the non-default Text Format extension, to be parsing attacker-controlled input through that extension, AND for downstream code to behave insecurely in the presence of a poisoned prototype - a confluence of conditions not present in most deployments. The unscoped (S:U) rating is correct since prototype pollution here affects only the parsed object within the same process context. No EPSS score was included in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV listing and no confirmed public POC code further reduce urgency. This is a real but narrow-scope vulnerability: for the majority of protobuf.js consumers using binary protobuf format, there is no exposure whatsoever. Risk is highest for Node.js services that ingest text-format protobuf from untrusted sources and use the result in property enumeration or prototype-inheriting code paths.

An attacker sends a crafted HTTP request body containing a protobuf text-format payload with a map entry whose key is literally __proto__ to a Node.js service that uses protobufjs/ext/textformat to parse incoming messages. The parser assigns the attacker-supplied value to __proto__ on the returned map object, polluting the JavaScript object prototype chain for that object and any downstream code that inherits or enumerates its properties. If downstream application logic iterates over the map or uses inherited prototype values to make authorization or routing decisions, the attacker may be able to read unintended fields or cause the application to process data under a tampered object model. No public exploit code has been identified at time of analysis.