CVE-2026-54270: Protobufjs DOS Vulnerability

CVE-2026-54270 Overview

CVE-2026-54270 affects protobufjs, a widely deployed Node.js library that compiles Protocol Buffer definitions into JavaScript functions. Versions from 8.2.0 through 8.4.2 preserve unknown wire elements in message.$unknowns during decode operations. The library does not expose a decode-time option to discard unknown fields. Attackers can submit crafted protobuf payloads containing many unknown fields to force decoded messages to retain substantially more memory than the input size suggests. The flaw is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Remote attackers can send crafted protobuf payloads to trigger excessive memory retention in applications decoding untrusted data, leading to availability degradation.

Affected Products

protobufjs 8.2.0 through 8.4.2 (Node.js)
Applications decoding untrusted protobuf payloads with default settings
Downstream packages bundling vulnerable protobufjs versions

Discovery Timeline

2026-06-22 - CVE-2026-54270 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54270

Vulnerability Analysis

The vulnerability stems from how protobufjs handles unknown wire-format elements during message decoding. When a decoder encounters fields that are not part of the compiled schema, the library stores them in the message.$unknowns array to support round-tripping. Versions 8.2.0 through 8.4.2 retain these elements unconditionally and do not provide an option to drop them at decode time.

An attacker who controls protobuf input can construct payloads containing many unknown fields. The decoded message retains substantially more memory than the wire-format input size would suggest. Applications that never round-trip unknown fields still pay this memory cost on every decode.

Version 8.5.0 introduced decode-time options to disable unknown-field retention. Version 8.6.2 changed the default behavior so unknown fields are discarded unless explicitly opted in.

Root Cause

The root cause is missing throttling on unknown-field retention combined with an insecure default. The decoder allocates and retains structures for every unknown field without a configurable limit or opt-out, mapping directly to [CWE-770].

Attack Vector

The attack vector is network-based. An attacker submits a crafted protobuf message over any channel that ultimately reaches a protobufjs decoder. The payload contains a large number of unknown fields encoded with tag numbers absent from the schema. Each decoded message inflates resident memory, and repeated requests can exhaust process memory. No authentication or user interaction is required.

No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-94rc-8x27-4472 for vendor technical details.

Detection Methods for CVE-2026-54270

Indicators of Compromise

Sustained growth of Node.js process resident set size (RSS) correlated with protobuf decoding endpoints
HTTP or RPC requests carrying protobuf payloads with anomalously high field counts relative to schema size
Increased garbage collection pressure and event-loop latency on services that parse external protobuf data

Detection Strategies

Inventory dependencies using npm ls protobufjs to identify direct and transitive usage of versions 8.2.0 through 8.4.2
Inspect application code for Type.decode() and Type.decodeDelimited() calls operating on untrusted input without keepCase/unknown-field configuration
Add instrumentation to log message.$unknowns.length for decoded payloads to surface anomalous unknown-field counts

Monitoring Recommendations

Track per-request memory allocation and heap retention metrics on services that decode external protobuf data
Alert on protobuf payloads where the ratio of unknown to known fields exceeds an established baseline
Correlate availability degradation events with upstream protobuf decoding activity in centralized logs

How to Mitigate CVE-2026-54270

Immediate Actions Required

Upgrade protobufjs to version 8.6.2 or later to inherit the secure default that discards unknown fields
For deployments unable to upgrade past 8.5.x, explicitly enable the decode-time option to disable unknown-field retention
Apply request-size limits and rate limiting on endpoints that decode untrusted protobuf payloads

Patch Information

Version 8.5.0 of protobufjs introduced decode-time options that allow applications to disable unknown-field retention. Version 8.6.2 flipped the default so unknown fields are discarded unless callers explicitly opt in. Both fixes are documented in the protobufjs GitHub Security Advisory GHSA-94rc-8x27-4472.

Workarounds

Validate incoming protobuf payload sizes at the edge before they reach the decoder
Wrap decode() calls to clear message.$unknowns immediately after decoding when round-tripping is not required
Restrict protobuf ingestion endpoints to authenticated clients to reduce exposure to untrusted input

bash

# Upgrade to the fixed release
npm install protobufjs@^8.6.2

# Verify installed version
npm ls protobufjs