protobufjs vulnerabilities
Protocol Buffers for JavaScript & TypeScript.
- Registry
- npm
- Latest
- 8.8.1
- License
- BSD-3-Clause
17 known advisories
The latest version, 8.8.1, is not affected by any of them. Projects on older versions may be.
npm install protobufjs@8.8.1Security advisories for protobufjs
protobufjs: Text Format string map parsing can mutate returned map object prototype
- Affected
- >=8.2.0 <8.6.5
- Fixed in
- 8.6.5
protobufjs: Denial of Service via infinite loop in .proto option parsing
- Affected
- >=7.5.0 <7.6.5 · >=8.0.0 <8.6.6
- Fixed in
- 7.6.5, 8.6.6
protobufjs: Memory amplification from preserved unknown fields in binary decode
- Affected
- >=8.2.0 <8.5.0
- Fixed in
- 8.5.0
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
- Affected
- <7.6.1 · >=8.0.0 <8.4.1
- Fixed in
- 7.6.1, 8.4.1
protobufjs : Schema-derived names can shadow runtime-significant properties
- Affected
- <7.6.3 · >=8.0.0 <8.6.0
- Fixed in
- 7.6.3, 8.6.0
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
- Affected
- <7.5.8 · >=8.0.0 <8.2.0
- Fixed in
- 7.5.8, 8.2.0
protobuf.js: Denial of service from crafted field names in generated code
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobuf.js: Code injection through bytes field defaults in generated toObject code
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobuf.js: Prototype injection in generated message constructors
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobuf.js: Code generation gadget after prototype pollution
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobuf.js: Process-wide denial of service through unsafe option paths
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobuf.js: Denial of service through unbounded protobuf recursion
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
protobufjs has overlong UTF-8 decoding
- Affected
- <7.5.6 · >=8.0.0 <8.0.2
- Fixed in
- 7.5.6, 8.0.2
Arbitrary code execution in protobufjs
- Affected
- >=8.0.0 <8.0.1 · <7.5.5
- Fixed in
- 7.5.5, 8.0.1
protobufjs Prototype Pollution vulnerability
- Affected
- >=7.0.0 <7.2.5 · >=6.10.0 <6.11.4
- Fixed in
- 6.11.4, 7.2.5
Prototype Pollution in protobufjs
- Affected
- >=6.11.0 <6.11.3 · >=6.10.0 <6.10.3
- Fixed in
- 6.10.3, 6.11.3
Denial of Service in protobufjs
- Affected
- >=6.0.0 <6.8.6 · <5.0.3
- Fixed in
- 5.0.3, 6.8.6
Which of your client projects still run an old protobufjs?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.