CVE-2026-44290

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 13, 2026, 2:41:15 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 25, 2026

A flaw was found in protobufjs. This vulnerability allows an attacker to craft a protobuf schema or JSON descriptor that, when processed, can traverse through inherited object properties. This can lead to writing to global JavaScript constructors, corrupting process-wide built-in functionality. The most significant impact is a denial of service (DoS). protobufjs: protobufjs: Denial of Service via crafted schema This is an Important denial of service vulnerability in protobufjs. A remote attacker could provide a specially crafted protobuf schema or JSON descriptor, which, when processed by an application using protobufjs, could corrupt process-wide built-in functionality, leading to a persistent denial of service. This impact is contingent on the application parsing untrusted schemas or descriptors. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.