What is the CVSS score of CVE-2026-59876?

CVE-2026-59876 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-59876?

Yes, a patch is available for CVE-2026-59876. Update the affected software to the latest version immediately.

protobuf.js CVE-2026-59876

EUVD-2026-42311 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-07-08 GitHub_M

GHSA-jfj6-75fj-8934

Information Disclosure Prototype Pollution Protobuf Js Red Hat

4.8

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

AV:N for network-deliverable input; AC:H because textformat extension must be in explicit use and downstream code must exhibit prototype-pollution-susceptible patterns; PR:N as no authentication is needed to submit crafted input; no availability impact from prototype pollution alone.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

4.8 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 17:01 EUVD

Analysis Generated

Jul 08, 2026 - 16:49 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

24 npm packages depend on protobufjs (1 direct, 23 indirect)

Ecosystem-wide dependent count for version 8.2.0.

DescriptionNVD

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

AnalysisAI

Prototype pollution in protobuf.js versions 8.2.0 through 8.6.4 allows network-reachable attackers to corrupt JavaScript object prototype chains via the Text Format extension, by supplying a map entry whose key is the reserved JavaScript token __proto__, causing the parser to overwrite the prototype of the returned map object instead of creating a literal own-property entry. Exploitation is constrained by high attack complexity - only applications explicitly using the optional /ext/textformat module and parsing attacker-controlled input are affected - and real-world impact is limited to partial confidentiality and integrity effects in downstream code that inherits or enumerates poisoned prototype properties. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

protobuf.js is a widely-used JavaScript/TypeScript library that compiles Protocol Buffer (protobuf) schema definitions into JS functions for serializing and deserializing structured data. The optional Text Format extension (protobufjs/ext/textformat) provides human-readable protobuf serialization, distinct from the default binary wire format. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - Prototype Pollution): the extension used ordinary bracket-notation property assignment (mapObject[key] = value) when constructing map return objects, without sanitizing keys against JavaScript reserved tokens. When key equals __proto__, the JavaScript engine interprets the assignment as a prototype chain mutation rather than a data property write. Safe alternatives include using Object.create(null) to produce prototype-less maps, using Object.defineProperty with explicit descriptor flags, or explicitly rejecting keys matching __proto__, constructor, and prototype. The affected CPE is cpe:2.3:a:protobufjs:protobuf.js:*:*:*:*:*:*:*:* for the version range 8.2.0-8.6.4.

RemediationAI

Vendor-released patch: 8.6.5 - upgrade the protobufjs npm package to version 8.6.5 or later, available at https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5. The upstream fix is documented in pull request https://github.com/protobufjs/protobuf.js/pull/2335 and commit 9f97fe413072d3beb52c74e62d88ea8adc9444d8. If immediate patching is not possible, the most effective workaround is to stop using the protobufjs/ext/textformat extension entirely and migrate to the default binary protobuf format, which is unaffected; this may require client-side changes if text-format is used for interoperability. If the text-format extension cannot be disabled, add an input validation layer that rejects or sanitizes map keys matching __proto__, constructor, or prototype before passing data to the parser - note this is a defense-in-depth measure only and should not replace patching.