Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Six vulnerabilities, dubbed Proto6, have been identified in protobuf.js, a JavaScript implementation of Protocol Buffers. These flaws could lead to remote code execution (RCE) and denial-of-service (DoS) attacks, primarily affecting Node.js applications that utilize the library. The vulnerabilities stem from the library’s default trust of schema and metadata, creating opportunities for attackers to inject malicious code.
The vulnerabilities, tracked as CVE-2026-44289 through CVE-2026-44295, were discovered by Cyera researchers and pose a significant risk to Node.js applications that process Protocol Buffers data. Specifically, the flaws include unbounded protobuf recursion (CVE-2026-44289), process-wide DoS attacks (CVE-2026-44290), code generation gadget exploitation (CVE-2026-44291), prototype injection (CVE-2026-44292), DoS from crafted field names (CVE-2026-44294), and code injection in static output (CVE-2026-44295). The vulnerabilities are particularly concerning given the widespread use of protobuf.js in CI/CD pipelines, messaging frameworks like Baileys, and Google Cloud client libraries. A potential attack scenario involves injecting a malicious protobuf schema into a CI/CD workflow, potentially leaking build secrets. The most critical vulnerability, CVE-2026-44291, allows for arbitrary JavaScript execution through prototype pollution.