CVE-2026-44294: protobuf.js: Denial of service from crafted field names in generated code

May 12, 2026 (updated May 14, 2026)

protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation.

References

github.com/advisories/GHSA-2pr8-phx7-x9h3
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3
nvd.nist.gov/vuln/detail/CVE-2026-44294

Code Behaviors & Features

Detect and mitigate CVE-2026-44294 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →