CVE-2026-54270: protobufjs Memory Amplification Vulnerability from Unknown Fields in Binary Decode
Summary
CVE-2026-54270: protobufjs: Memory amplification from preserved unknown fields in binary decode. Affects protobufjs versions >= 8.2.0, < 8.5.0. Fixed in 8.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
protobufjs is a popular JavaScript library used for encoding and decoding Protocol Buffers, a method developed by Google for serializing structured data. It allows developers to work with binary data efficiently and is widely used in applications that require data interchange. However, versions 8.2.0 to 8.4.2 of protobufjs introduced a vulnerability that allows unknown fields to be preserved during binary decoding, leading to potential memory amplification issues.
Vulnerability Detail
The vulnerability arises from the addition of support for preserving unknown fields in protobufjs version 8.2.0. When decoding binary data, unknown fields are stored in 'message.$unknowns', which can lead to excessive memory usage if an attacker sends a crafted payload with numerous unknown fields. This can degrade application performance and availability, especially in services that decode untrusted protobuf data. The issue is exacerbated if the application does not enforce strict input size or concurrency limits.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.5.0
This is the first release that contains the fix.
npm install protobufjs@8.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can implement a workaround by creating a Reader and setting the discardUnknown property to true before decoding:
const reader = new protobuf.Reader();
reader.discardUnknown = true;
const message =
reader.
decode(buffer);
This will prevent the retention of unknown fields during decoding.
Conclusion
The memory amplification vulnerability in protobufjs due to the preservation of unknown fields can lead to significant memory usage and potential application degradation. It is crucial to upgrade to the patched version or implement the provided workaround to mitigate risks associated with this vulnerability.
See every vulnerability recorded for protobufjs →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Versions 8.2.0 to 8.4.2 of protobufjs are affected by this vulnerability.
Unknown fields are fields in a protobuf message that are not defined in the schema. They are treated as unknown and can be preserved in certain versions of protobufjs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If immediate upgrading is not possible, implement the workaround by setting the discardUnknown property to true when creating a Reader to mitigate the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
