{"id":"EUVD-2026-30032","enisaUuid":"14476211-913a-3bce-ab02-b45017c69dac","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.","datePublished":"May 13, 2026, 2:44:30 PM","dateUpdated":"May 13, 2026, 6:34:31 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3\n","aliases":"CVE-2026-44294\nGHSA-2pr8-phx7-x9h3\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"0816fa7e-410c-3150-a2c0-99585ec356ff","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.0.0, \u003c 8.0.2"},{"id":"ec5e751e-05df-30c0-bd08-83c9a01745f1","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"\u003c 7.5.6"}],"enisaIdVendor":[{"id":"86c5d793-374c-3f9c-9baf-a90bc12e222f","vendor":{"name":"protobufjs"}}],"enisaIdVulnerability":[{"id":"b3efcfeb-72d4-3e86-926d-572d311d59e6","vulnerability":{"id":"CVE-2026-44294","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.","datePublished":"May 13, 2026, 2:44:30 PM","dateUpdated":"May 13, 2026, 6:34:31 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3\n","enisa_id":"EUVD-2026-30032\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Nov 13, 2026, 7:22:15 AM","vulnerabilityProduct":[{"id":"21b3fa3b-dec9-3d4d-838e-7441f8222b22","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.0.0, \u003c 8.0.2"},{"id":"f2edc24f-4388-38cf-bf43-ca340f0f2d0c","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"\u003c 7.5.6"}],"vulnerabilityVendor":[{"id":"04e10682-3b46-33ff-b623-1e3c2e58b9fe","vendor":{"name":"protobufjs"}}]}},{"id":"bd29acc2-d04a-3ae4-99c9-d9c2e9253307","vulnerability":{"id":"GHSA-2pr8-phx7-x9h3","description":"protobuf.js: Denial of service from crafted field names in generated code","datePublished":"May 12, 2026, 3:06:17 PM","dateUpdated":"May 14, 2026, 8:35:22 PM","baseScore":0.0,"references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-2pr8-phx7-x9h3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44294\nhttps://github.com/protobufjs/protobuf.js\nhttps://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6\nhttps://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2\n","enisa_id":"EUVD-2026-30032\n","aliases":"CVE-2026-44294\nGHSA-2pr8-phx7-x9h3\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:47:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}