ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54269 CVE-2026-54269 in protobufjs - Patched by Root

Root has patched CVE-2026-54269 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44294 CVE-2026-44294 in protobufjs - Patched by Root

Root has patched CVE-2026-44294 in the protobufjs package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

Summary IBM Maximo Application Suite uses axios-1.15.2.tgz, protobufjs-8.0.1.tgz, protobufjs-8.2.0.tgz and undici-7.26.0.tgz which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-54270, CVE-2026-45740,...

Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs

Summary There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs mentioned below. Vulnerability Details CVEID:CVE-2026-48712 DESCRIPTION: protobuf...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

ROOT-APP-NPM-CVE-2026-59877 CVE-2026-59877 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-59877 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54270 CVE-2026-54270 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-54270 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends...

CVE-2026-59877

A flaw was found in protobufjs, a JavaScript JS library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions ...

EUVD-2026-42311

protobufjs: Text Format string map parsing can mutate returned map object prototype...

protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...

@agentgate-hedera/passport (>=0.1.1, <=0.1.3), @aliceo2/bookkeeping (1.19.0) +116 more potentially affected by CVE-2026-59876 via protobufjs (>=8.2.0, <=8.6.4)

protobufjs NPM version =8.2.0, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.37, =0.1.29, =9.1.1-az29, =9.1.1-az31 - @freon4dsl/core 3.0.0-beta.1 - @freon4dsl/core-svelte 3.0.0-beta.1 and more Source cves: CVE-2026-59876 Source advisory: OSV:GHSA-JFJ6-75FJ-8934...

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype vulnerability discovered by ? in WordPress Npm protobufjs versions = 8.2.0, = 8.6.4...

GHSA-JFJ6-75FJ-8934 protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...

protobufjs: Denial of Service via infinite loop in .proto option parsing

Summary protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating. This affects the...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1136 more potentially affected by CVE-2026-59877 via protobufjs (>=8.0.0, <=8.6.5)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-59877 Source advisory: OSV:GHSA-J3F2-48V5-CCWW...

EUVD-2026-42310

protobufjs: Denial of Service via infinite loop in .proto option parsing...

NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing

NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing vulnerability discovered by ? in WordPress Npm protobufjs versions = 7.5.0, = 7.6.4...