CVE-2026-44293: protobuf.js Code Injection via Unsafe Default Values in bytes Field
Summary
CVE-2026-44293: protobuf.js: Code injection through bytes field defaults in generated toObject code. Affects protobufjs across 2 version ranges.
< 7.5.6
>= 8.0.0, < 8.0.2
Fixed in 7.5.6 or 8.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
protobuf.js is a popular JavaScript library used for encoding and decoding Protocol Buffers, a method developed by Google for serializing structured data. It allows developers to define data structures in a schema and provides tools to serialize and deserialize these structures efficiently. However, vulnerabilities in its handling of schema-controlled default values can lead to security risks, particularly code injection attacks.
Vulnerability Detail
The vulnerability arises from the way protobuf.js generates JavaScript code for the 'toObject' conversion function. If an attacker can control or influence the protobuf descriptor, they can define a 'bytes' field with a non-string default value. This can lead to the emission of unsafe expressions in the generated code, allowing the execution of arbitrary JavaScript in the context of the application using protobuf.js. The implications are severe, as it could lead to unauthorized code execution and potential system compromise.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.5.67.5.6npm install protobufjs@7.5.6 -
>= 8.0.0, < 8.0.28.0.2npm install protobufjs@8.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Avoid loading protobuf schemas or JSON descriptors from untrusted sources. If you must accept untrusted schemas, validate or restrict field options before loading them, and consider running schema processing in an isolated environment.
Conclusion
The vulnerability CVE-2026-44293 in protobuf.js poses a significant risk due to potential code injection through unsafe default values in bytes fields. It is crucial for developers to update to the latest patched versions and implement recommended workarounds to mitigate risks.
See every vulnerability recorded for protobufjs →
FAQ
CVE-2026-44293 is a vulnerability in protobuf.js that allows for code injection through unsafe default values in bytes fields.
An attacker can exploit this vulnerability by providing a crafted protobuf descriptor with a malicious default value for a bytes field, leading to arbitrary code execution.
Versions of protobuf.js up to 7.5.5 and 8.0.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
If immediate updates are not possible, ensure that you do not load schemas from untrusted sources and validate any untrusted schemas before processing them.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
