CVE-2026-44290: protobufjs project protobufjs

csirt@kutim:~/threat-intel/cve/CVE-2026-44290

CVSS 7.5 · High EPSS 0,50%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada protobufjs project protobufjs. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

Rincian

Terbit di NVD: 13 Mei 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS (30 hari): 0,50% peluang dieksploitasi; lebih tinggi dari 40,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
protobufjs project	protobufjs	Semua versi sebelum 7.5.6
protobufjs project	protobufjs	Versi 8.0.0 hingga sebelum 8.0.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.