Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. protobufjs
  4. ›
  5. CVE-2026-59876

CVE-2026-59876: protobufjs: Text Format string map parsing can mutate returned map object prototype

July 20, 2026

The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key __proto__ could therefore change the prototype of the returned map object instead of creating an own map entry.

This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected.

References

  • github.com/advisories/GHSA-jfj6-75fj-8934
  • github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8
  • github.com/protobufjs/protobuf.js/pull/2335
  • github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5
  • github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934
  • nvd.nist.gov/vuln/detail/CVE-2026-59876

Code Behaviors & Features

Detect and mitigate CVE-2026-59876 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 8.2.0 before 8.6.5

Fixed versions

  • 8.6.5

Solution

Upgrade to version 8.6.5 or above.

Impact 4.8 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Source file

npm/protobufjs/CVE-2026-59876.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:18:33 +0000.