Is protobufjs 8.4 vulnerable?
npm · 3 releases from 8.4.0 to 8.4.2 · latest protobufjs is 8.8.1 · checked 1 Nov 2026
Yes: 4 known advisories
Yes. protobufjs 8.4.2, the last 8.4 release, is affected by 4 known security advisories (4 medium), including CVE-2026-59876, CVE-2026-59877, CVE-2026-54270. 1 more affects earlier 8.4.x releases. Upgrade to 8.6.6 or later to fix all of them.
npm install protobufjs@8.6.6Advisories affecting protobufjs 8.4.2
protobufjs: Text Format string map parsing can mutate returned map object prototype
- Affected
- >=8.2.0 <8.6.5
- Fixed in
- 8.6.5
protobufjs: Denial of Service via infinite loop in .proto option parsing
- Affected
- >=7.5.0 <7.6.5 · >=8.0.0 <8.6.6
- Fixed in
- 7.6.5, 8.6.6
protobufjs: Memory amplification from preserved unknown fields in binary decode
- Affected
- >=8.2.0 <8.5.0
- Fixed in
- 8.5.0
protobufjs : Schema-derived names can shadow runtime-significant properties
- Affected
- <7.6.3 · >=8.0.0 <8.6.0
- Fixed in
- 7.6.3, 8.6.0
Fixed within 8.4.x, affecting earlier releases
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
- Affected
- <7.6.1 · >=8.0.0 <8.4.1
- Fixed in
- 7.6.1, 8.4.1
Which of your client projects are still on protobufjs 8.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact protobufjs version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other protobufjs versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.