CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype

What is CVE-2026-59876?

CVE-2026-59876 is a medium-severity vulnerability in protobufjs protobuf.js, published on 8 Jul 2026.

Official description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

Weakness: CWE-1321

Which versions are affected by CVE-2026-59876?

2 open source packages ship an affected version, including protobufjs. It affects 1 product.

Products include Protobufjs Project Protobufjs.

How do I fix CVE-2026-59876?

Upgrade protobufjs to 8.6.5 or later.

Is CVE-2026-59876 being exploited?

There is no known exploitation of CVE-2026-59876 in the wild and no public exploit code.

Other vulnerabilities in protobufjs protobuf.js

• CVE-2023-36665 protobufjs Prototype Pollution vulnerability Critical 9.8
• CVE-2026-41242 protobufjs has an arbitrary code execution issue Critical 9.4
• CVE-2022-25878 Prototype Pollution High 8.2
• CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution High 8.1
• CVE-2026-44293 protobufjs: Code injection through bytes field defaults in generated toObject code High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-FF01212, GHSA-jfj6-75fj-8934, MINI-8g7c-2p9h-899g.