{"uuid": "e42d37d1-c7af-45a8-85ec-326cda7c35af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54269", "type": "seen", "source": "https://gist.github.com/alon710/e1c58c0e5e300cd65a71e5b861eaf325", "content": "# CVE-2026-54269: CVE-2026-54269: Runtime Property Shadowing and Denial of Service in protobufjs\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54269\n\n## Summary\nA property shadowing vulnerability exists in protobufjs where schema-derived names can collide with and overwrite runtime-critical internal helper properties. This issue leads to uncaught runtime exceptions and crash-based Denial of Service.\n\n## TL;DR\nUntrusted protobuf schemas can define fields matching internal properties (such as 'hasOwnProperty' or 'rpcCall'), triggering uncaught runtime exceptions that crash the execution thread (Denial of Service).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-754, CWE-674\n- **Attack Vector**: Network\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.0024 (Percentile: 14.70%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- protobufjs\n- protobufjs-cli\n- **protobufjs**: < 7.6.3 (Fixed in: `7.6.3`)\n- **protobufjs**: >= 8.0.0, < 8.6.0 (Fixed in: `8.6.0`)\n- **protobufjs-cli**: < 1.3.3 (Fixed in: `1.3.3`)\n- **protobufjs-cli**: >= 2.0.0, < 2.5.1 (Fixed in: `2.5.1`)\n\n## Mitigation\n\n- Upgrade the dependency package to a patched release version.\n- Establish strict schema validation rules to filter out conflict-prone property names.\n- Ensure process management tools are configured to restart terminated nodes automatically.\n\n**Remediation Steps:**\n1. Locate and review package.json configurations for protobufjs and protobufjs-cli.\n2. Update protobufjs to 7.6.3 or 8.6.0 depending on the active major version.\n3. Update protobufjs-cli to 1.3.3 or 2.5.1 to secure static code generation.\n4. Regenerate any pre-compiled JavaScript static schema files using the updated CLI.\n5. Deploy runtime validation logic to reject schema definitions containing the strings 'hasOwnProperty' or 'rpcCall'.\n\n## References\n\n- [GitHub Security Advisory (GHSA-f38q-mgvj-vph7)](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7)\n- [NVD CVE Record (CVE-2026-54269)](https://nvd.nist.gov/vuln/detail/CVE-2026-54269)\n- [CVE.org CVE Record (CVE-2026-54269)](https://www.cve.org/CVERecord?id=CVE-2026-54269)\n- [Pull Request #2311: Avoid shadowing prototype properties](https://github.com/protobufjs/protobuf.js/pull/2311)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54269) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:59:30.626821Z"}