The weak point is not just direct use of protobuf.js. It is the trust boundary around schemas and metadata, because attacker-controlled input can be turned into generated JavaScript and run inside the Node.js process.
Cyera disclosed six protobuf.js vulnerabilities, including CVE-2026-44291 and CVE-2026-44295, across the core library and the protobuf.js-cli code generator. The package has more than 50 million weekly downloads and is commonly inherited through gRPC tooling, Google Cloud libraries, and other transitive dependencies, so many affected applications will not find it by checking only direct installs.
That makes patching a supply-chain problem, not a single-library fix. If code generators or shared libraries pull protobuf.js into your build path, the exposed code paths can exist even where teams never chose the package themselves.
2 sources · Jun 10
CVEs in this update
6 CVEs
Across Secure Connect Gateway, Ansible Automation Platform.
Researchers at Cyera found six vulnerabilities in protobuf.js, including a flaw that can turn attacker-controlled schema data into executable code and expose downstream software supply chains.