GHSA-h755-8qp9-cq85 CVE-2023-36665

protobufjs Prototype Pollution vulnerability

Critical npm

Severity: 9.8 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 1.70%; Chance of exploitation in the next 30 days. Higher than 77.16% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Fix: 7.2.5; Upgrade protobufjs to this version or later

Description

protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about Object.constructor.prototype.<new-property> = ...; whereas CVE-2022-25878 was about Object.__proto__.<new-property> = ...; instead.

Affected versions

npm

Package	Vulnerable	Fixed in
protobufjs	`>= 7.0.0, < 7.2.5`	`7.2.5`
protobufjs	`>= 6.10.0, < 6.11.4`	`6.11.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

protobufjs npm → `7.2.5`

npm

npm install protobufjs@7.2.5

yarn

yarn add protobufjs@7.2.5

pnpm

pnpm add protobufjs@7.2.5

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it

Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation: When handling untrusted objects, validating using a schema can be used.
Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2023-36665

Packages

github.com/protobufjs/protobuf.js

Timeline

Jul 5, 2023 Published
Aug 7, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-j3f2-48v5-ccww protobufjs: Denial of Service via infinite loop in .proto option parsing	High	Also affects protobufjs
GHSA-jfj6-75fj-8934 protobufjs: Text Format string map parsing can mutate returned map object prototype	Medium	Also affects protobufjs
GHSA-94rc-8x27-4472 protobufjs: Memory amplification from preserved unknown fields in binary decode	Medium	Also affects protobufjs
GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion	High	Also affects protobufjs
GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties	Medium	Also affects protobufjs
GHSA-jggg-4jg4-v7c6 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion	High	Also affects protobufjs
GHSA-2pr8-phx7-x9h3 protobuf.js: Denial of service from crafted field names in generated code	Medium	Also affects protobufjs
GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code	High	Also affects protobufjs

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor