The weak point is not just direct use of protobuf.js. It is the trust boundary around schemas and metadata, because attacker-controlled input can be turned into generated JavaScript and run inside the Node.js process.
Cyera disclosed six protobuf.js vulnerabilities, including CVE-2026-44291 and CVE-2026-44295, across the core library and the protobuf.js-cli code generator. The package has more than 50 million weekly downloads and is commonly inherited through gRPC tooling, Google Cloud libraries, and other transitive dependencies, so many affected applications will not find it by checking only direct installs.
That makes patching a supply-chain problem, not a single-library fix. If code generators or shared libraries pull protobuf.js into your build path, the exposed code paths can exist even where teams never chose the package themselves.