CVE-2026-44291

A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This prototype pollution vulnerability occurs when Object.prototype is polluted, allowing attacker-controlled properties to be resolved as valid protobuf type information. This can lead to attacker-controlled strings being emitted into generated JavaScript code, potentially resulting in arbitrary code execution.

This Important flaw in protobufjs, a JavaScript library, potentially enables arbitrary code execution when a separate prototype pollution vulnerability is present in an application. Exploitation requires an attacker to first pollute Object.prototype and then trigger protobufjs functionality that generates encode or decode code for affected types. Red Hat products utilizing protobufjs may be impacted if they are vulnerable to prototype pollution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation involves preventing prototype pollution within applications that utilize protobufjs. Administrators should ensure that untrusted input cannot pollute Object.prototype in the application or its dependencies. Additionally, isolating schema and message processing from untrusted application states can prevent attacker-controlled properties from being resolved as valid protobuf type information.