Prototype pollution in protobuf.js - CVE-2026-44290
Published: May 12, 2026
Vulnerability identifier: #VU131165
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44290
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper control of prototype-based property paths in protobufjs reflection APIs when parsing attacker-controlled protobuf schemas or JSON descriptors. A remote attacker can provide a specially crafted schema or descriptor to cause a denial of service.
Applications that only decode untrusted protobuf message payloads using bundled, generated, or otherwise trusted schemas are not directly affected.
Affected software
protobuf.js
Ansible Automation Platform
Ansible Automation Platform
How to mitigate CVE-2026-44290
Install security update from vendor's website.
protobuf.js - addressed in versions 7.5.6, 8.0.2
Ansible Automation Platform - update to 2.2.0
Ansible Automation Platform - update to 2.2.0