Is protobufjs 3.6 vulnerable?

npm · 1 release from 3.6.0 to 3.6.0 · latest protobufjs is 8.8.1 · checked 2 Nov 2026

Yes: 12 known advisories

Yes. protobufjs 3.6.0, the last 3.6 release, is affected by 12 known security advisories (1 critical, 5 high, 6 medium), including CVE-2026-41242, CVE-2026-48712, CVE-2026-44293. Upgrade to 7.6.3 or later to fix all of them.

Upgrade with:npm install protobufjs@7.6.3

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting protobufjs 3.6.0

  • HighCVE-2026-48712GHSA-wcpc-wj8m-hjx615 Jun 2026

    protobufjs: Denial of service through unbounded Any expansion during JSON conversion

    Affected
    <7.6.1 · >=8.0.0 <8.4.1
    Fixed in
    7.6.1, 8.4.1
  • MediumCVE-2026-54269GHSA-f38q-mgvj-vph715 Jun 2026

    protobufjs : Schema-derived names can shadow runtime-significant properties

    Affected
    <7.6.3 · >=8.0.0 <8.6.0
    Fixed in
    7.6.3, 8.6.0
  • MediumCVE-2026-45740GHSA-jggg-4jg4-v7c619 May 2026

    protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

    Affected
    <7.5.8 · >=8.0.0 <8.2.0
    Fixed in
    7.5.8, 8.2.0
  • MediumCVE-2026-44294GHSA-2pr8-phx7-x9h312 May 2026

    protobuf.js: Denial of service from crafted field names in generated code

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • HighCVE-2026-44293GHSA-66ff-xgx4-vchm12 May 2026

    protobuf.js: Code injection through bytes field defaults in generated toObject code

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • MediumCVE-2026-44292GHSA-fx83-v9x8-x52w12 May 2026

    protobuf.js: Prototype injection in generated message constructors

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • HighCVE-2026-44291GHSA-75px-5xx7-5xc712 May 2026

    protobuf.js: Code generation gadget after prototype pollution

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • HighCVE-2026-44290GHSA-jvwf-75h9-cwgg12 May 2026

    protobuf.js: Process-wide denial of service through unsafe option paths

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • HighCVE-2026-44289GHSA-685m-2w69-288q12 May 2026

    protobuf.js: Denial of service through unbounded protobuf recursion

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • MediumCVE-2026-44288GHSA-q6x5-8v7m-xcrf12 May 2026

    protobufjs has overlong UTF-8 decoding

    Affected
    <7.5.6 · >=8.0.0 <8.0.2
    Fixed in
    7.5.6, 8.0.2
  • CriticalCVE-2026-41242GHSA-xq3m-2v4x-88gg16 Apr 2026

    Arbitrary code execution in protobufjs

    Affected
    >=8.0.0 <8.0.1 · <7.5.5
    Fixed in
    7.5.5, 8.0.1
  • MediumCVE-2018-3738GHSA-762f-c2wg-m8c89 Oct 2018

    Denial of Service in protobufjs

    Affected
    >=6.0.0 <6.8.6 · <5.0.3
    Fixed in
    5.0.3, 6.8.6

Which of your client projects are still on protobufjs 3.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact protobufjs version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other protobufjs versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.