CVE-2026-44288 Overview
CVE-2026-44288 affects protobuf.js, a widely used JavaScript library that compiles Protocol Buffer definitions into JavaScript functions. The library shipped a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them with the Unicode replacement character. Attackers who control protobuf binary payloads can craft byte sequences that pass raw-byte inspection but decode into different strings once protobuf parses them. The issue is tracked as an improper encoding or escaping of output weakness [CWE-176] and is fixed in versions 7.5.6 and 8.0.2.
Critical Impact
Applications that inspect raw protobuf bytes for forbidden ASCII characters before string decoding may be bypassed, allowing smuggled content to reach downstream consumers.
Affected Products
- protobufjs versions prior to 7.5.6 in the 7.x release line
- protobufjs versions prior to 8.0.2 in the 8.x release line
- Node.js and browser applications that decode untrusted protobuf payloads through the affected UTF-8 path
Discovery Timeline
- 2026-05-13 - CVE-2026-44288 published to the National Vulnerability Database
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44288
Vulnerability Analysis
The protobuf.js library decodes string fields from wire-format bytes using an inlined UTF-8 reader optimized for performance. UTF-8 specifies that each code point has exactly one valid minimum-length encoding. Encoders must not emit longer sequences to represent the same character. The vulnerable decoder skipped that validation and translated overlong two-, three-, or four-byte sequences into the same code point as their canonical single-byte form.
Applications commonly inspect protobuf payloads at the raw-bytes layer before parsing. A filter searching for the ASCII slash (0x2F), null byte, or other control characters in the raw stream will not see those bytes when an attacker substitutes an overlong encoding such as 0xC0 0xAF. Once protobuf.js parses the message, the decoded string contains the smuggled character. The result is an encoding desynchronization between security controls and the parsed object [CWE-176].
Root Cause
The minimal UTF-8 decoder in protobuf.js did not enforce the shortest-form rule defined in RFC 3629. Standards-compliant decoders replace overlong sequences with U+FFFD (the Unicode replacement character) rather than the canonical code point. The library prioritized decoder size and speed over strict validation.
Attack Vector
An attacker submits a protobuf-encoded message over any network or local channel the application accepts. String fields are populated with overlong UTF-8 sequences chosen to evade upstream byte-level checks. After protobuf.js decodes the message, downstream code receives strings containing characters the security layer was configured to block. Exploitation does not require authentication or user interaction and operates over the network.
No code example is published with this advisory. See the GitHub Security Advisory GHSA-q6x5-8v7m-xcrf for upstream technical details.
Detection Methods for CVE-2026-44288
Indicators of Compromise
- Protobuf payloads containing byte sequences such as 0xC0 0xAF, 0xE0 0x80 0xAF, or 0xF0 0x80 0x80 0xAF that decode to ASCII /
- Application logs showing decoded string fields with characters that should have been rejected by an upstream byte filter
- Discrepancies between raw-byte audit logs and post-parse string logs for the same protobuf message
Detection Strategies
- Add a post-decode validation layer that re-encodes decoded strings to UTF-8 and compares the result against the original raw bytes
- Instrument protobuf entry points to flag any message whose raw bytes contain 0xC0, 0xC1, or 5- and 6-byte sequence starters that are never valid in shortest-form UTF-8
- Run dependency scanners to enumerate any service using protobufjs below 7.5.6 or 8.0.2
Monitoring Recommendations
- Monitor inbound API gateways and message brokers that carry protobuf traffic for anomalous byte distributions in string fields
- Track the version of protobufjs resolved in production package-lock.json and yarn.lock files across builds
- Alert on application errors emitted by stricter parsers downstream that reject overlong UTF-8 after protobuf.js accepts it
How to Mitigate CVE-2026-44288
Immediate Actions Required
- Upgrade protobufjs to 7.5.6 or 8.0.2 or later across all Node.js, browser, and serverless workloads
- Audit transitive dependencies, since many gRPC and message-broker client libraries embed protobufjs
- Review application-level allowlists and denylists that inspect protobuf bytes before decoding and shift them to post-decode validation
Patch Information
The maintainers fixed the issue in protobufjs7.5.6 and 8.0.2. The patched decoder rejects overlong UTF-8 sequences and substitutes the Unicode replacement character U+FFFD. Refer to the protobuf.js Security Advisory GHSA-q6x5-8v7m-xcrf for release notes and commit references.
Workarounds
- Validate decoded strings against business rules after protobuf.js parses the message rather than scanning raw bytes
- Wrap calls into protobuf.js with a sanitizer that rejects messages containing bytes 0xC0 or 0xC1, which never appear in valid shortest-form UTF-8
- Where feasible, route untrusted protobuf traffic through a stricter parser, such as Google's reference protobuf implementation, before passing data to protobuf.js
# Upgrade protobufjs in a Node.js project
npm install protobufjs@^8.0.2
# Or pin to the 7.x patched line
npm install protobufjs@^7.5.6
# Verify the resolved version
npm ls protobufjs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
