CVE-2026-54269 Overview
CVE-2026-54269 affects protobufjs, a widely used Node.js library that compiles Protocol Buffer definitions into JavaScript functions. The vulnerability stems from improper handling of schema-derived names that collide with internal runtime helper properties. An attacker supplying a crafted schema can trigger deterministic exceptions or recursive calls during decode, verification, object conversion, or RPC helper invocation. The flaw is tracked as [CWE-674] (Uncontrolled Recursion) and is fixed in versions 8.6.0 and 7.6.3. The issue impacts both protobufjs and protobufjs-cli packages.
Critical Impact
Crafted protobuf schemas containing reserved field names such as hasOwnProperty, $type, or rpcCall can crash protobufjs runtime helpers, causing denial of service in applications that load untrusted schemas.
Affected Products
- protobufjs versions prior to 7.6.3 (7.x branch)
- protobufjs versions prior to 8.6.0 (8.x branch)
- protobufjs-cli (Node.js)
Discovery Timeline
- 2026-06-22 - CVE-2026-54269 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-54269
Vulnerability Analysis
The vulnerability resides in how protobufjs resolves schema-derived names against its runtime helper properties. When a protobuf schema defines a field named hasOwnProperty, the library can read schema-controlled data instead of invoking the JavaScript own-property helper. The same collision occurs when reflection descriptors include $type field or oneof names, which clash with reflected type metadata. Service methods generating a helper named rpcCall collide with the base RPC helper used during invocation. These name collisions produce deterministic exceptions or recursive call chains in decode post-checks, verification routines, object conversion logic, JSON serialization, and RPC dispatch.
Root Cause
The root cause is the absence of namespace separation between user-controlled schema identifiers and internal helper properties on protobufjs runtime objects. The library trusted schema input to define properties without screening for reserved names. When generated code or reflection metadata references these names, the lookup resolves to attacker-controlled data rather than the intended helper function.
Attack Vector
Exploitation requires the target application to load a protobuf schema or process messages defined by an attacker. The attack vector is network-based and requires no authentication or user interaction. An attacker who can supply .proto definitions, JSON descriptors, or service definitions consumed by a vulnerable protobufjs instance can trigger the condition. The impact is limited to availability, manifesting as runtime exceptions or stack overflows from recursive helper invocation.
No verified exploitation code is published. Refer to the GitHub Security Advisory GHSA-f38q-mgvj-vph7 for advisory details.
Detection Methods for CVE-2026-54269
Indicators of Compromise
- Unexpected TypeError or RangeError exceptions originating from protobufjs modules such as decode, verify, toObject, or rpcCall.
- Application crashes with stack traces showing recursive calls into protobufjs helper functions.
- Increased error rates from services accepting external .proto or JSON-defined schemas.
Detection Strategies
- Inventory all Node.js applications and dependencies that reference protobufjs versions earlier than 7.6.3 or 8.6.0 using npm ls protobufjs.
- Scan loaded schemas and JSON descriptors for field names matching hasOwnProperty, $type, or service methods named rpcCall.
- Configure software composition analysis tooling to flag the vulnerable version ranges in build pipelines.
Monitoring Recommendations
- Monitor application logs for repeated exceptions inside protobufjs runtime helpers and correlate with incoming schema or message sources.
- Track CPU spikes and stack overflow events on services that deserialize protobuf payloads from untrusted clients.
- Alert on dependency drift when protobufjs is upgraded or downgraded across deployments.
How to Mitigate CVE-2026-54269
Immediate Actions Required
- Upgrade protobufjs to version 7.6.3 on the 7.x branch or 8.6.0 on the 8.x branch.
- Upgrade protobufjs-cli to a release that depends on a patched protobufjs version.
- Audit transitive dependencies for pinned vulnerable versions and rebuild lockfiles after upgrade.
Patch Information
The maintainers released fixes in protobufjs8.6.0 and 7.6.3. The patches add screening for reserved property names so schema-derived identifiers no longer collide with runtime helpers. See the GitHub Security Advisory GHSA-f38q-mgvj-vph7 for the official fix details.
Workarounds
- Reject schemas that contain field names matching hasOwnProperty, oneof or field names of $type, or service methods producing rpcCall helpers.
- Restrict schema loading to trusted sources and validate descriptors before passing them to protobufjs reflection APIs.
- Wrap protobufjs decode and RPC entry points with error handlers that contain exceptions and prevent service-level crashes.
# Upgrade protobufjs to a patched release
npm install protobufjs@^8.6.0
# or for the 7.x line
npm install protobufjs@^7.6.3
# Verify installed version
npm ls protobufjs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
