{"id":"EUVD-2026-38307","revision":"b6039260e92443a9b3fa5cd6c044af1c","records":[{"revision":"b6039260e92443a9b3fa5cd6c044af1c","observedAt":"2026-10-30T09:50:40.373+00:00","statement":{"source":"euvd","id":"EUVD-2026-38307","aliases":["CVE-2026-54269","GHSA-f38q-mgvj-vph7"],"title":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected na…","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38307","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 22, 2026, 4:23:24 PM","dateUpdated":"Jun 23, 2026, 4:09:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38307","identifiers":["EUVD-2026-38307","CVE-2026-54269","GHSA-f38q-mgvj-vph7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}