Vulnerabilities · 96 days ago
The weak point is not just direct use of protobuf.js. It is the trust boundary around schemas and metadata, because attacker-controlled input can be turned into generated JavaScript and run inside the Node.js process.
Cyera disclosed six protobuf.js vulnerabilities, including CVE-2026-44291 and CVE-2026-44295, across the core library and the protobuf.js-cli code generator. The package has more than 50 million weekly downloads and is commonly inherited through gRPC tooling, Google Cloud libraries, and other transitive dependencies, so many affected applications will not find it by checking only direct installs.
That makes patching a supply-chain problem, not a single-library fix. If code generators or shared libraries pull protobuf.js into your build path, the exposed code paths can exist even where teams never chose the package themselves.
CVEs in this update
6 CVEs
Across Secure Connect Gateway, Ansible Automation Platform.
0 critical · 4 high · 2 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-44295 · 8.7 HIGH
Highest EPSS: CVE-2026-44289 · 0.63%
2 sources covering this story
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Six Proto6 flaws in protobuf.js enable RCE and DoS attacks; patched in versions 7.5.6 and 8.0.2 to protect Node.js services.
Protocol Buffers schemas expose remote code execution risk
Researchers at Cyera found six vulnerabilities in protobuf.js, including a flaw that can turn attacker-controlled schema data into executable code and expose downstream software supply chains.
Part of the PlainSec briefing for 2026-06-11