CVE-2026-59876: protobufjs: Text Format string map parsing can mutate returned map object prototype
The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key __proto__ could therefore change the prototype of the returned map object instead of creating an own map entry.
This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected.
References
- github.com/advisories/GHSA-jfj6-75fj-8934
- github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8
- github.com/protobufjs/protobuf.js/pull/2335
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5
- github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934
- nvd.nist.gov/vuln/detail/CVE-2026-59876
Code Behaviors & Features
Detect and mitigate CVE-2026-59876 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →