protobufjs (npm)
Advisories
34
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.6.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install protobufjs@8.6.6yarn
yarn add protobufjs@8.6.6pnpm
pnpm add protobufjs@8.6.6Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-j3f2-48v5-ccww protobufjs: Denial of Service via infinite loop in .proto option parsing |
High EPSS 0.36% |
>= 7.5.0, < 7.6.5 | 7.6.5 |
| GHSA-j3f2-48v5-ccww protobufjs: Denial of Service via infinite loop in .proto option parsing |
High EPSS 0.36% |
>= 8.0.0, < 8.6.6 | 8.6.6 |
| GHSA-jfj6-75fj-8934 protobufjs: Text Format string map parsing can mutate returned map object prototype |
Medium EPSS 0.35% |
>= 8.2.0, < 8.6.5 | 8.6.5 |
| GHSA-94rc-8x27-4472 protobufjs: Memory amplification from preserved unknown fields in binary decode |
Medium EPSS 0.40% |
>= 8.2.0, < 8.5.0 | 8.5.0 |
| GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion |
High EPSS 0.46% |
>= 8.0.0, < 8.4.1 | 8.4.1 |
| GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion |
High EPSS 0.46% |
< 7.6.1 | 7.6.1 |
| GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties |
Medium EPSS 0.40% |
>= 8.0.0, < 8.6.0 | 8.6.0 |
| GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties |
Medium EPSS 0.40% |
< 7.6.3 | 7.6.3 |
| GHSA-jggg-4jg4-v7c6 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion |
High EPSS 0.26% |
>= 8.0.0, < 8.2.0 | 8.2.0 |
| GHSA-jggg-4jg4-v7c6 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion |
High EPSS 0.26% |
< 7.5.8 | 7.5.8 |
| GHSA-2pr8-phx7-x9h3 protobuf.js: Denial of service from crafted field names in generated code |
Medium EPSS 0.43% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-2pr8-phx7-x9h3 protobuf.js: Denial of service from crafted field names in generated code |
Medium EPSS 0.43% |
< 7.5.6 | 7.5.6 |
| GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code |
High EPSS 0.41% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code |
High EPSS 0.41% |
< 7.5.6 | 7.5.6 |
| GHSA-fx83-v9x8-x52w protobuf.js: Prototype injection in generated message constructors |
Medium EPSS 0.26% |
< 7.5.6 | 7.5.6 |
| GHSA-fx83-v9x8-x52w protobuf.js: Prototype injection in generated message constructors |
Medium EPSS 0.26% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-75px-5xx7-5xc7 protobuf.js: Code generation gadget after prototype pollution |
High EPSS 0.50% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-75px-5xx7-5xc7 protobuf.js: Code generation gadget after prototype pollution |
High EPSS 0.50% |
< 7.5.6 | 7.5.6 |
| GHSA-jvwf-75h9-cwgg protobuf.js: Process-wide denial of service through unsafe option paths |
High EPSS 0.37% |
< 7.5.6 | 7.5.6 |
| GHSA-jvwf-75h9-cwgg protobuf.js: Process-wide denial of service through unsafe option paths |
High EPSS 0.37% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-685m-2w69-288q protobuf.js: Denial of service through unbounded protobuf recursion |
High EPSS 0.63% |
< 7.5.6 | 7.5.6 |
| GHSA-685m-2w69-288q protobuf.js: Denial of service through unbounded protobuf recursion |
High EPSS 0.63% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding |
Medium EPSS 0.30% |
< 7.5.6 | 7.5.6 |
| GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding |
Medium EPSS 0.30% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs |
Critical EPSS 0.77% |
< 7.5.5 | 7.5.5 |
| GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs |
Critical EPSS 0.77% |
>= 8.0.0, < 8.0.1 | 8.0.1 |
| GHSA-h755-8qp9-cq85 protobufjs Prototype Pollution vulnerability |
Critical EPSS 1.70% |
>= 7.0.0, < 7.2.5 | 7.2.5 |
| GHSA-h755-8qp9-cq85 protobufjs Prototype Pollution vulnerability |
Critical EPSS 1.70% |
>= 6.10.0, < 6.11.4 | 6.11.4 |
| GHSA-g954-5hwp-pp24 Prototype Pollution in protobufjs |
High EPSS 2.33% |
>= 6.11.0, < 6.11.3 | 6.11.3 |
| GHSA-g954-5hwp-pp24 Prototype Pollution in protobufjs |
High EPSS 2.33% |
>= 6.10.0, < 6.10.3 | 6.10.3 |
| GHSA-4gpv-cvmq-6526 Denial of Service in protobufjs Withdrawn |
Medium | >= 6.0.0, < 6.8.6 | 6.8.6 |
| GHSA-4gpv-cvmq-6526 Denial of Service in protobufjs Withdrawn |
Medium | < 5.0.3 | 5.0.3 |
| GHSA-762f-c2wg-m8c8 Denial of Service in protobufjs |
Medium EPSS 0.94% |
>= 6.0.0, < 6.8.6 | 6.8.6 |
| GHSA-762f-c2wg-m8c8 Denial of Service in protobufjs |
Medium EPSS 0.94% |
< 5.0.3 | 5.0.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor