CVE-2026-44288
MEDIUM EPSS 21.7%
Published May 13, 20261mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Published May 13, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
21.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-176
Affected Products 2
| Vendor | Product | Version | Range |
|---|---|---|---|
| protobufjs_project | protobufjs | * | <7.5.6 |
| protobufjs_project | protobufjs | * | ≥8.0.0 – <8.0.2 |
References 1
- github.com https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-q6x5-8v7m-xcrf
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.