CVE-2026-54269

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 8.6.0 protobufjs versions prior to 7.6.3

Description protobufjs accepts certain schema-derived names that collide with properties used by runtime helpers. Specifically, this occurs with fields named hasOwnProperty, field or oneof names such as $type when loaded via JSON/reflection descriptors, and service methods that generate a helper name of rpcCall. When these types are used, the software may read schema-controlled data instead of the expected own-property helper, reflected type metadata, or base RPC helper. This can lead to deterministic exceptions or recursive calls during decode post-checks, verification, object conversion, reflected JSON serialization, or RPC helper invocation, potentially resulting in a denial of service for the affected processing path.

Recommendations Update to version 8.6.0 or 7.6.3. Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources. If untrusted schemas must be accepted, validate and reject schema-derived field, oneof, and service method names that match the problematic names before loading. For trusted schemas, rename affected fields or service methods, or avoid the affected API path.