{"id":"EUVD-2026-38305","enisaUuid":"605217ab-3ac2-35a9-b516-3ed067c7945f","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.","datePublished":"Jun 22, 2026, 4:19:20 PM","dateUpdated":"Jun 23, 2026, 4:09:51 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-94rc-8x27-4472\n","aliases":"CVE-2026-54270\nGHSA-94rc-8x27-4472\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"4dc6318c-8057-3187-a23d-6e5b890e0199","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.2.0, \u003c 8.5.0"}],"enisaIdVendor":[{"id":"9e94d309-381f-3fe8-a876-890c1b594629","vendor":{"name":"protobufjs"}}],"enisaIdVulnerability":[{"id":"02f1de72-8359-3dbd-97e7-0e48736c41ef","vulnerability":{"id":"GHSA-94rc-8x27-4472","description":"protobufjs: Memory amplification from preserved unknown fields in binary decode","datePublished":"Jun 15, 2026, 8:13:28 PM","dateUpdated":"Jul 15, 2026, 10:06:10 PM","baseScore":0.0,"references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-94rc-8x27-4472\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54270\nhttps://github.com/protobufjs/protobuf.js\n","enisa_id":"EUVD-2026-38305\n","aliases":"GHSA-94rc-8x27-4472\nCVE-2026-54270\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"25dd6aba-1496-3325-9432-a0704ca313bf","vulnerability":{"id":"CVE-2026-54270","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.","datePublished":"Jun 22, 2026, 4:19:20 PM","dateUpdated":"Jun 23, 2026, 4:09:51 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-94rc-8x27-4472\n","enisa_id":"EUVD-2026-38305\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"086acf9f-0257-33cc-8bfe-11eac58aa5da","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.2.0, \u003c 8.5.0"}],"vulnerabilityVendor":[{"id":"1efd0148-b49d-36c4-a2f7-ebb73fb4d6c5","vendor":{"name":"protobufjs"}}]}}],"enisaIdAdvisory":[]}