CVE-2022-25878: Prototype Pollution in protobufjs
Summary
CVE-2022-25878: Prototype Pollution in protobufjs. Affects protobufjs across 2 version ranges.
>= 6.10.0, < 6.10.3
>= 6.11.0, < 6.11.3
Fixed in 6.10.3 or 6.11.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package protobufjs is an open-source JavaScript library that provides an implementation of Protocol Buffers, a language-agnostic binary serialization format. It is commonly used for data interchange between different systems. The library allows developers to define message types and generate code for encoding and decoding data in the Protocol Buffers format. Unfortunately, protobufjs is vulnerable to a Prototype Pollution attack, which can lead to unauthorized modification of the Object.prototype. This vulnerability affects versions 6.10.0 to 6.10.3 and 6.11.0 to 6.11.3 of the package.
Vulnerability Detail
The vulnerability in protobufjs arises due to the improper handling of user input and the parsing/loading of .proto files. Attackers can exploit this vulnerability by providing untrusted user input to the util.setProperty or ReflectionObject.setParsedOption functions. By manipulating the input, an attacker can add or modify properties of the Object.prototype, potentially leading to various security issues such as arbitrary code execution, privilege escalation, or information disclosure.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.10.0, < 6.10.36.10.3npm install protobufjs@6.10.3 -
>= 6.11.0, < 6.11.36.11.3npm install protobufjs@6.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using the affected functions (util.setProperty and ReflectionObject.setParsedOption) with untrusted user input. It is crucial to validate and sanitize any user input before passing it to these functions. Implementing strict input validation and using a secure parsing mechanism for .proto files can also help mitigate the risk of exploitation.
Conclusion
The vulnerability in protobufjs exposes applications to the risk of Prototype Pollution, which can have severe security implications. It is crucial to update the package to the latest version and implement proper input validation to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for protobufjs →
FAQ
protobufjs is an open-source JavaScript library that provides an implementation of Protocol Buffers, a binary serialization format used for data interchange between different systems.
Prototype Pollution is a vulnerability that allows an attacker to modify the Object.prototype, which can lead to various security issues such as code execution, privilege escalation, or information disclosure.
The vulnerability in protobufjs can be exploited by providing untrusted user input to the util.setProperty or ReflectionObject.setParsedOption functions. By manipulating the input, an attacker can modify the Object.prototype and potentially execute arbitrary code or escalate privileges.
The consequences of this vulnerability include arbitrary code execution, privilege escalation, and information disclosure. An attacker could exploit the vulnerability to execute malicious code on the affected system, gain elevated privileges, or access sensitive information.
To protect your application from this vulnerability, it is recommended to update the protobufjs package to version 6.11.4 or later. Additionally, ensure that any user input passed to the affected functions is properly validated and sanitized to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
