CVE-2023-36665: protobufjs Prototype Pollution vulnerability
Summary
CVE-2023-36665: protobufjs Prototype Pollution vulnerability. Affects protobufjs across 2 version ranges.
>= 6.10.0, < 6.11.4
>= 7.0.0, < 7.2.5
Fixed in 6.11.4 or 7.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
protobufjs is an open-source JavaScript library that provides an implementation of Protocol Buffers, a language-agnostic binary serialization format. It allows developers to define message types and generate code for sending and receiving structured data. The library is widely used in various applications and frameworks to facilitate efficient data exchange. However, versions 6.10.0 to 7.2.4 of protobufjs are vulnerable to a Prototype Pollution vulnerability.
Vulnerability Detail
The Prototype Pollution vulnerability in protobufjs allows an attacker to manipulate the prototype of Object.prototype by adding and overwriting its data and functions. This can be achieved by providing a user-controlled protobuf message, which can be parsed using the parse function, loading .proto files with the load/loadSync functions, or supplying untrusted input to the ReflectionObject.setParsedOption and util.setProperty functions. Exploiting this vulnerability can lead to various consequences, such as arbitrary code execution, data tampering, or denial of service.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.10.0, < 6.11.46.11.4npm install protobufjs@6.11.4 -
>= 7.0.0, < 7.2.57.2.5npm install protobufjs@7.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization to mitigate the risk of Prototype Pollution. By carefully validating and filtering user-controlled input before using it in protobufjs functions, the impact of this vulnerability can be reduced. Here is an example of input sanitization using a regular expression in JavaScript:
const sanitizedInput = userProvidedInput.replace(/[<>]/g, '');
Conclusion
The protobufjs Prototype Pollution vulnerability exposes applications using affected versions of the library to potential security risks. It is crucial for developers to promptly update their dependencies and implement input validation to mitigate the risk. For further support and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for protobufjs →
FAQ
protobufjs is a JavaScript library that implements Protocol Buffers, a binary serialization format used for structured data exchange.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to potential security issues such as code execution or data tampering.
The vulnerability can be exploited by providing a user-controlled protobuf message and using functions like parse, load/loadSync, ReflectionObject.setParsedOption, or util.setProperty with untrusted input.
Exploiting this vulnerability can result in arbitrary code execution, data tampering, or denial of service, depending on the attacker's intentions.
To mitigate the risk, it is recommended to update to a secure version of protobufjs (7.2.4 or higher), sanitize user input, and follow secure coding practices.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
