CVE-2026-59876: Protobufjs Privilege Escalation Vulnerability

CVE-2026-59876 Overview

CVE-2026-59876 is a prototype pollution vulnerability [CWE-1321] in protobufjs, a widely-used library that compiles Protocol Buffers definitions into JavaScript functions. The flaw resides in the protobufjs/ext/textformat extension, which parses string-keyed map entries using ordinary property assignment. An attacker who supplies a Text Format payload containing a map entry with the key __proto__ can modify the prototype of the returned map object rather than creating an own property. Versions 8.2.0 through 8.6.4 are affected, and the issue is fixed in version 8.6.5.

Critical Impact

Attackers who control Text Format input to applications using protobufjs can pollute object prototypes, potentially altering application logic, bypassing security checks, or causing denial of service depending on downstream code paths.

Affected Products

• protobufjs versions 8.2.0 through 8.6.4
• Applications using the protobufjs/ext/textformat extension to parse untrusted Text Format input
• Node.js and browser projects that transitively depend on vulnerable protobufjs versions

Discovery Timeline

• 2026-07-08 - CVE-2026-59876 published to NVD
• 2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59876

Vulnerability Analysis

The vulnerability affects the Text Format parsing path inside protobufjs/ext/textformat. When the parser encounters a map<string, V> field, it constructs the returned map using a standard JavaScript object literal {} and populates entries with direct property assignment. JavaScript object literals inherit from Object.prototype, so writing to reserved keys such as __proto__, constructor, or prototype mutates inherited state instead of adding an own property. An attacker supplying a Text Format message with a map entry keyed on __proto__ can therefore inject properties into Object.prototype, affecting every object in the runtime.

Root Cause

The root cause is the use of inherited-property semantics for internal map storage. Any object created via {} or new Object() participates in prototype chain lookups, so keys such as __proto__ are interpreted as prototype setters rather than data. The fix replaces these constructors with Object.create(null), producing prototype-less objects that treat __proto__ as a normal string key.

Attack Vector

Exploitation requires the target application to pass attacker-controlled Text Format input into the protobufjs Text Format decoder. The attack is network-reachable and requires no privileges or user interaction, but attack complexity is high because the attacker must land on a downstream sink where the polluted prototype influences security-relevant logic. Successful exploitation yields limited integrity and confidentiality impact scoped to the affected JavaScript runtime.

// Patch excerpt from cli/targets/proto.js
// Replace inherited-property map with a prototype-less object
function consolidateExtends(nested) {
-    var ext = {};
+    var ext = Object.create(null);
    nested = nested.filter(function(obj) {
        if (!(obj instanceof Field) || obj.extend === undefined)
            return true;

Source: GitHub Commit 9f97fe4

// Patch excerpt from cli/targets/static.js
// Use Object.create(null) for the valuesById lookup map
push((config.es6 ? "const" : "var") + " valuesById = " +
     globalRef("Object") + ".create(null), values = " +
     globalRef("Object") + ".create(valuesById);");

Source: GitHub Commit 9f97fe4

Detection Methods for CVE-2026-59876

Indicators of Compromise

• Text Format payloads containing map keys __proto__, constructor, or prototype submitted to services that parse Protocol Buffers text input
• Unexpected properties appearing on Object.prototype at runtime, such as newly injected functions or values on standard object literals
• Node.js process crashes or logic anomalies originating from stack frames inside protobufjs/ext/textformat

Detection Strategies

• Perform Software Composition Analysis on package-lock.json and yarn.lock files to enumerate protobufjs versions between 8.2.0 and 8.6.4
• Instrument the Text Format parser or a wrapper to log and reject reserved key names before they reach map assignment
• Add runtime assertions that verify Object.getPrototypeOf({}) equals Object.prototype after handling untrusted input

Monitoring Recommendations

• Track dependency inventories through your SBOM pipeline and alert on any workload still resolving vulnerable protobufjs builds
• Monitor application logs for Text Format decode errors correlated with malformed or attacker-supplied requests
• Alert on abnormal exception patterns in Node.js services that consume Protocol Buffers text data from external sources

How to Mitigate CVE-2026-59876

Immediate Actions Required

• Upgrade protobufjs to version 8.6.5 or later across all direct and transitive dependencies
• Rebuild and redeploy any container images or serverless bundles that shipped with the vulnerable library
• Audit application code for direct use of the protobufjs/ext/textformat extension against untrusted input

Patch Information

The fix is available in protobufjs version 8.6.5. The patch replaces object-literal map storage with Object.create(null) inside the Text Format extension, eliminating prototype chain lookups on map keys. See the GitHub Security Advisory GHSA-jfj6-75fj-8934, the pull request #2335, and the 8.6.5 release notes for full details.

Workarounds

• Avoid parsing untrusted Text Format input until the upgrade is deployed; prefer the binary wire format where feasible
• Pre-validate incoming Text Format payloads and reject any that contain reserved keys such as __proto__, constructor, or prototype
• Freeze Object.prototype at process start using Object.freeze(Object.prototype) in environments that tolerate the behavioral change

# Upgrade protobufjs to the patched release
npm install protobufjs@8.6.5

# Verify the resolved version across the dependency tree
npm ls protobufjs

# For yarn-based projects
yarn upgrade protobufjs@8.6.5
yarn why protobufjs