{"id":"EUVD-2026-38307","enisaUuid":"1476cf0b-3e77-3d96-9266-a602fae8a7f7","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.","datePublished":"Jun 22, 2026, 4:23:24 PM","dateUpdated":"Jun 23, 2026, 4:09:36 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7\n","aliases":"CVE-2026-54269\nGHSA-f38q-mgvj-vph7\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"2ec46736-034a-36da-8c87-b29557a839cf","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.0.0, \u003c 8.6.0"},{"id":"b7cb40ad-a054-35fd-a86b-bde47b6f97a0","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"\u003c 7.6.3"}],"enisaIdVendor":[{"id":"a9d83bc5-1513-397d-9937-a57f067b8989","vendor":{"name":"protobufjs"}}],"enisaIdVulnerability":[{"id":"2393021d-2a9f-3a22-9344-3b013dd8e2a8","vulnerability":{"id":"GHSA-f38q-mgvj-vph7","description":"protobufjs : Schema-derived names can shadow runtime-significant properties","datePublished":"Jun 15, 2026, 5:27:18 PM","dateUpdated":"Jul 15, 2026, 10:06:05 PM","baseScore":0.0,"references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54269\nhttps://github.com/protobufjs/protobuf.js\n","enisa_id":"EUVD-2026-38307\n","aliases":"GHSA-f38q-mgvj-vph7\nCVE-2026-54269\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"480837fc-7e93-3e29-954c-4984f5e119ca","vulnerability":{"id":"CVE-2026-54269","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.","datePublished":"Jun 22, 2026, 4:23:24 PM","dateUpdated":"Jun 23, 2026, 4:09:36 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7\n","enisa_id":"EUVD-2026-38307\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"3c7485ef-423a-3fac-a3ea-d6c2616f8c5b","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.0.0, \u003c 8.6.0"},{"id":"98089691-ed48-3394-a60f-aef797bf8b9d","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"\u003c 7.6.3"}],"vulnerabilityVendor":[{"id":"71bf5dcf-f877-3a79-8cac-341c071dd16f","vendor":{"name":"protobufjs"}}]}}],"enisaIdAdvisory":[]}