CVE-2026-59876: protobufjs Vulnerability in Text Format Parsing Leading to Prototype Manipulation
Summary
CVE-2026-59876: protobufjs: Text Format string map parsing can mutate returned map object prototype. Affects protobufjs versions >= 8.2.0, < 8.6.5. Fixed in 8.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
protobufjs is a popular JavaScript library used for encoding and decoding Protocol Buffers, a language-neutral, platform-neutral extensible mechanism for serializing structured data. It provides a range of functionalities, including support for binary encoding and decoding, as well as a text format extension for easier human readability. However, a vulnerability exists in the text format parsing that allows for unintended prototype manipulation, which can lead to security issues if not addressed.
Vulnerability Detail
The vulnerability arises from the way protobuf.js handles string-keyed map entries in its text format extension. Specifically, when parsing input, if an attacker provides a key named 'proto', it can alter the prototype of the returned map object instead of creating a new map entry. This can lead to per-object prototype mutation, which may have serious implications if downstream application logic treats inherited properties as meaningful. The impact is contingent upon the application's handling of these properties, potentially allowing attackers to manipulate application behavior.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.6.5
This is the first release that contains the fix.
npm install protobufjs@8.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, avoid parsing untrusted protobuf Text Format input with affected versions. Additionally, reject any string map keys named 'proto' before or during parsing. Use own-property checks when accessing parsed map objects, as shown in the following code snippet:
if (Object.hasOwnProperty.call(map, key)) {
// Safe to access map[key]
}
Conclusion
The vulnerability CVE-2026-59876 in protobufjs poses a risk of prototype manipulation through improper handling of text format input. It is crucial for developers to upgrade to the patched version or implement workarounds to safeguard their applications from potential exploitation.
See every vulnerability recorded for protobufjs →
FAQ
The vulnerability allows an attacker to manipulate the prototype of a returned map object by providing a key named 'proto' in the text format input.
If your application processes untrusted protobuf text format input and relies on inherited properties from parsed map objects, it may lead to unexpected behavior or security issues.
Versions of protobufjs prior to 8.6.5 are affected by this vulnerability.
Upgrade to protobufjs version 8.6.5 or newer to mitigate the vulnerability. If an upgrade is not possible, implement workarounds to avoid parsing untrusted input.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
