CVE-2026-44290: protobuf.js: Process-wide denial of service through unsafe option paths

May 12, 2026 (updated May 14, 2026)

protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality.

References

github.com/advisories/GHSA-jvwf-75h9-cwgg
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg
nvd.nist.gov/vuln/detail/CVE-2026-44290

Code Behaviors & Features

Detect and mitigate CVE-2026-44290 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →