CVE-2026-59876

Name of the Vulnerable Software and Affected Versions protobufjs versions 8.2.0 through 8.6.4

Description The protobufjs Text Format extension parses string-keyed map entries using ordinary property assignment. This allows a map entry with the key proto to modify the prototype of the returned map object instead of creating a standard map entry in protobufjs/ext/textformat. Prototype pollution occurs when an attacker can manipulate the proto property, potentially leading to unexpected behavior or security bypasses by altering the base object properties inherited by other objects.

Recommendations Update to version 8.6.5.