CVE-2026-54270 protobufjs: Memory amplification from preserved unknown fields in binary decode

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown...

@agentgate-hedera/passport (>=0.1.1, <=0.1.3), @aliceo2/bookkeeping (1.19.0) +80 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.37, =0.1.29, =9.1.1-az29, =9.1.1-az31 - @hiero-ledger/sdk 2.85.0 - @identikey/metacoding 0.2.0 and more Source cves: CVE-2026-54270 Source advisory: OSV:GHSA-94RC-8X27-4472...

@agentgate-hedera/passport (>=0.1.1, <=0.1.3), @aliceo2/bookkeeping (1.19.0) +80 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.37, =0.1.29, =9.1.1-az29, =9.1.1-az31 - @hiero-ledger/sdk 2.85.0 - @identikey/metacoding 0.2.0 and more Source cves: CVE-2026-54270 Source advisory: SNYK:JS-PROTOBUFJS-17353318...