7.7
High
CVE-2026-44293 protobufjs compiles protobuf definitions into JavaScript (JS) functions
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| protobuf.js 8.0 | 8.0.0 → < 8.0.2 | 8.0.2 |
| protobuf.js 7.5 | earliest → < 7.5.6 | 7.5.6 |
| Red Hat Developer Hub 1.9 1781187342 | earliest → < 1781187342 | 1781187342 |
| Red Hat OpenShift Service Mesh 3.3 1780997438 | earliest → < 1780997438 | 1780997438 |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Hardened Images | Versions not published | |
| Red Hat OpenShift Container Platform 4.22 1782224390 | earliest → < 1782224390 | 1782224390 |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1782761510 | earliest → < 1782761510 | 1782761510 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Versions not published | |
| Red Hat OpenShift Container Platform 4.21 1783502338 | earliest → < 1783502338 | 1783502338 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat OpenShift Container Platform 4.20 1783602326 | earliest → < 1783602326 | 1783602326 |
| Red Hat OpenShift Container Platform 4.2 1783602326 | earliest → < 1783602326 | 1783602326 |
| Red Hat OpenShift AI 3.4 1787250617 | earliest → < 1787250617 | 1787250617 |
| Red Hat OpenShift Container Platform 4.18 1787031447 | earliest → < 1787031447 | 1787031447 |
| Red Hat OpenShift Container Platform 4.19 1786486822 | earliest → < 1786486822 | 1786486822 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of protobuf.js
The 16 CVEs of protobuf.js →
CVE-2026-59876
protobufjs compiles protobuf definitions into JavaScript (JS) functions
4.8
Medium
CVE-2026-59877
protobufjs compiles protobuf definitions into JavaScript (JS) functions
5.3
Medium
CVE-2026-54269
protobufjs compiles protobuf definitions into JavaScript (JS) functions
5.3
Medium
CVE-2026-48712
protobufjs compiles protobuf definitions into JavaScript (JS) functions
7.5
High