GHSA-JFJ6-75FJ-8934
Vulnerability from github – Published: 2026-07-20 22:04 – Updated: 2026-07-20 22:04Summary
The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key __proto__ could therefore change the prototype of the returned map object instead of creating an own map entry.
This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected.
Impact
An attacker who can provide protobuf text-format input parsed by an application using protobufjs/ext/textformat may be able to create message objects whose string-keyed map fields have attacker-controlled prototypes.
This is per-object prototype mutation, not global Object.prototype pollution. Impact depends on downstream application logic treating inherited properties as meaningful, for example by using in, truthiness checks, or direct property access on parsed map objects instead of own-property checks.
Applications that do not parse untrusted Text Format input, or that do not use inherited properties from parsed map objects in security-relevant logic, are not directly affected.
Preconditions
- The application must parse attacker-controlled protobuf Text Format input with
protobufjs/ext/textformat. - The target schema must contain a string-keyed map field.
- The crafted input must provide a map entry with key
__proto__. - Downstream application logic must treat inherited properties on the returned map object as meaningful for impact beyond malformed output.
Workarounds
Upgrade to protobufjs 8.6.5 or newer.
If immediate upgrade is not possible, do not parse untrusted protobuf Text Format input with affected versions. Applications can also reject string map keys named __proto__ before or during Text Format parsing, and should use own-property checks such as Object.hasOwnProperty.call(map, key) when consuming parsed map objects.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.6.4"
},
"package": {
"ecosystem": "npm",
"name": "protobufjs"
},
"ranges": [
{
"events": [
{
"introduced": "8.2.0"
},
{
"fixed": "8.6.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59876"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T22:04:07Z",
"nvd_published_at": "2026-07-08T16:16:34Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key `__proto__` could therefore change the prototype of the returned map object instead of creating an own map entry.\n\nThis affected the optional Text Format extension. Other protobufjs input paths, including binary decode, `fromObject`, and ProtoJSON conversion, are not affected.\n\n## Impact\n\nAn attacker who can provide protobuf text-format input parsed by an application using `protobufjs/ext/textformat` may be able to create message objects whose string-keyed map fields have attacker-controlled prototypes.\n\nThis is per-object prototype mutation, not global `Object.prototype` pollution. Impact depends on downstream application logic treating inherited properties as meaningful, for example by using `in`, truthiness checks, or direct property access on parsed map objects instead of own-property checks.\n\nApplications that do not parse untrusted Text Format input, or that do not use inherited properties from parsed map objects in security-relevant logic, are not directly affected.\n\n## Preconditions\n\n* The application must parse attacker-controlled protobuf Text Format input with `protobufjs/ext/textformat`.\n* The target schema must contain a string-keyed map field.\n* The crafted input must provide a map entry with key `__proto__`.\n* Downstream application logic must treat inherited properties on the returned map object as meaningful for impact beyond malformed output.\n\n## Workarounds\n\nUpgrade to protobufjs 8.6.5 or newer.\n\nIf immediate upgrade is not possible, do not parse untrusted protobuf Text Format input with affected versions. Applications can also reject string map keys named `__proto__` before or during Text Format parsing, and should use own-property checks such as `Object.hasOwnProperty.call(map, key)` when consuming parsed map objects.",
"id": "GHSA-jfj6-75fj-8934",
"modified": "2026-07-20T22:04:07Z",
"published": "2026-07-20T22:04:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59876"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/pull/2335"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8"
},
{
"type": "PACKAGE",
"url": "https://github.com/protobufjs/protobuf.js"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "protobufjs: Text Format string map parsing can mutate returned map object prototype"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.