CVE-2026-44294: falha de média gravidade em protobufjs protobuf.js
protobufjs: Denial of service from crafted field names in generated code
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
protobufjs · protobuf.jsCVEs relacionadas — protobufjs protobuf.js
No mesmo produto, das mais perigosas para as menos.
CVE-2026-41242CRITICALprotobufjs has an arbitrary code execution issueEPSS 0.8%CVE-2026-44289HIGHprotobufjs: Denial of service through unbounded protobuf recursionEPSS 0.6%CVE-2026-44291HIGHprotobufjs: Code generation gadget after prototype pollutionEPSS 0.5%CVE-2026-48712HIGHprotobufjs: Denial of service through unbounded Any expansion during JSON conversionEPSS 0.5%CVE-2026-44293HIGHprotobufjs: Code injection through bytes field defaults in generated toObject codeEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%