CVE-2026-44290
Fixed in a distro release EPSS <1%CVSS 7.5
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
Products: protobufjs protobuf.js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | protobufjs | 7.5.6 |
| npm | protobufjs | 8.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cadence-web | 4.0.15-r2 |
| Chainguard | gemini-cli | 0.44.0-r0 |
| Chainguard | homepage | 1.13.1-r3 |
| Chainguard | kibana-8.19 | 8.19.15-r0 |
| Chainguard | kibana-8.19-bitnami | 8.19.15-r0 |
| Chainguard | kibana-8.19-iamguarded | 8.19.15-r0 |
| Chainguard | kibana-9.0 | 9.0.8-r29 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r29 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r29 |
| Chainguard | kibana-9.1 | 9.1.10-r18 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r18 |
| Chainguard | kibana-9.3 | 9.3.4-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.4-r4 |
| Chainguard | kibana-9.4 | 9.4.2-r0 |
| Chainguard | kibana-9.4 | 9.4.2-r2 |
| Chainguard | kibana-9.4-iamguarded | 9.4.2-r0 |
| Chainguard | kibana-9.4-iamguarded | 9.4.2-r2 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r21 |
| Chainguard | langfuse-fips-3.152 | no fix |
| Chainguard | langfuse-fips-3.152-worker | no fix |
| Chainguard | librechat | 0.8.4-r7 |
| Chainguard | nemo | 2.7.3-r11 |
| Chainguard | opentelemetry-auto-instrumentations-node | 0.76.0-r0 |
| Chainguard | pulumi-language-nodejs | 3.237.0-r1 |
| Chainguard | renovate | 43.170.15-r2 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-23 | 23.0.4-r5 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r21 |
| Wolfi | pulumi-language-nodejs | 3.237.0-r1 |
| Wolfi | renovate | 43.170.15-r2 |
| Wolfi | vitess-23 | 23.0.4-r5 |