CVE-2026-44290 protobufjs: Process-wide denial of service through unsafe option paths

High 7.5 Published 13 May 2026 Updated 14 May 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-44290?

CVE-2026-44290 is a high-severity vulnerability in protobufjs protobuf.js, published on 13 May 2026.

Official description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

Weakness: CWE-1321

Which versions are affected by CVE-2026-44290?

4 open source packages ship an affected version, including protobufjs. It affects 1 product.

Package	Affected	Fixed in
`protobufjs` npm	All versions	`7.5.6`
`protobufjs` npm	All versions	`7.5.6`
`protobufjs` npm	From `8.0.0`	`8.0.2`
`protobufjs` npm	From `8.0.0`	`8.0.2`

Products include Protobufjs Project Protobufjs.

How do I fix CVE-2026-44290?

Upgrade protobufjs to a fixed version for your release line: 7.5.6 or 8.0.2.

Is CVE-2026-44290 being exploited?

There is no known exploitation of CVE-2026-44290 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-ED10498, CLEANSTART-2026-IB28503, CLEANSTART-2026-OM20895, ECHO-577d-e467-484d, GHSA-jvwf-75h9-cwgg, MINI-3pj3-rpwq-r4xc and 16 more.