Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-44294

Fixed in a distro release EPSS <1%CVSS 5.3

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.

Published 2026-05-13 · CVE record · OSV

Products: protobufjs protobuf.js

Fixed upstream

EcosystemPackageFixed in
npmprotobufjs7.5.6
npmprotobufjs8.0.2

Distro releases

ReleasePackageFixed in
Chainguardcadence-web4.0.15-r2
Chainguardgemini-cli0.44.0-r0
Chainguardhomepage1.13.1-r3
Chainguardkibana-8.198.19.15-r0
Chainguardkibana-8.19-bitnami8.19.15-r0
Chainguardkibana-8.19-iamguarded8.19.15-r0
Chainguardkibana-9.09.0.8-r29
Chainguardkibana-9.0-bitnami9.0.8-r29
Chainguardkibana-9.0-iamguarded9.0.8-r29
Chainguardkibana-9.19.1.10-r18
Chainguardkibana-9.1-iamguarded9.1.10-r18
Chainguardkibana-9.39.3.4-r4
Chainguardkibana-9.3-iamguarded9.3.4-r4
Chainguardkibana-9.49.4.2-r0
Chainguardkibana-9.49.4.2-r2
Chainguardkibana-9.4-iamguarded9.4.2-r2
Chainguardkibana-9.4-iamguarded9.4.2-r0
Chainguardkubeflow-centraldashboard1.10.0-r21
Chainguardlibrechat0.8.4-r7
Chainguardnemo2.7.3-r11
Chainguardopentelemetry-auto-instrumentations-node0.76.0-r0
Chainguardpulumi-language-nodejs3.237.0-r1
Chainguardrenovate43.170.15-r2
Chainguardvitess-22no fix
Chainguardvitess-2323.0.4-r5
Wolfikubeflow-centraldashboard1.10.0-r21
Wolfipulumi-language-nodejs3.237.0-r1
Wolfirenovate43.170.15-r2
Wolfivitess-2323.0.4-r5