CVE-2026-59876

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8	Patch
https://github.com/protobufjs/protobuf.js/pull/2335	Issue Tracking Patch
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5	Product Release Notes
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) protobufjs compila definiciones de protobuf en funciones de JavaScript (JS). Desde la versión 8.2.0 hasta la 8.6.5, la extensión de formato de texto de protobufjs analizaba las entradas de mapa con claves de cadena utilizando la asignación de propiedades ordinaria, lo que permitía que una entrada de mapa con la clave __proto__ cambiara el prototipo del objeto de mapa devuelto en lugar de crear una entrada de mapa propia en protobufjs/ext/textformat. Este problema está solucionado en la versión 8.6.5.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59876

Mitre link : CVE-2026-59876

CVE.ORG link : CVE-2026-59876

JSON object : View

Products Affected

protobufjs_project

protobufjs

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-59876", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59876", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:41:36.435616Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "protobufjs", "product": "protobuf.js", "versions": [{"status": "affected", "version": ">= 8.2.0, < 8.6.5"}]}]}], "published": "2026-07-08T16:16:34.233", "references": [{"url": "https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/pull/2335", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5."}, {"lang": "es", "value": "protobufjs compila definiciones de protobuf en funciones de JavaScript (JS). Desde la versi\u00f3n 8.2.0 hasta la 8.6.5, la extensi\u00f3n de formato de texto de protobufjs analizaba las entradas de mapa con claves de cadena utilizando la asignaci\u00f3n de propiedades ordinaria, lo que permit\u00eda que una entrada de mapa con la clave __proto__ cambiara el prototipo del objeto de mapa devuelto en lugar de crear una entrada de mapa propia en protobufjs/ext/textformat. Este problema est\u00e1 solucionado en la versi\u00f3n 8.6.5."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8A2830C5-3D82-48A6-A85C-C6CD0D271B32", "versionEndExcluding": "8.6.5", "versionStartIncluding": "8.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}