{"id":"EUVD-2026-42311","enisaUuid":"f6cf04a5-3457-3b3a-8c14-187821304d67","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.","datePublished":"Jul 8, 2026, 3:31:11 PM","dateUpdated":"Jul 9, 2026, 2:41:45 PM","baseScore":4.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934\nhttps://github.com/protobufjs/protobuf.js/pull/2335\nhttps://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8\nhttps://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5\n","aliases":"CVE-2026-59876\nGHSA-jfj6-75fj-8934\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"956b51f0-3f83-30ac-a6ff-122c4ef1fb25","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.2.0, \u003c 8.6.5"}],"enisaIdVendor":[{"id":"51bb9f15-313e-38ab-a205-7a63f393fc6e","vendor":{"name":"protobufjs"}}],"enisaIdVulnerability":[{"id":"20b25921-aed4-3fa6-8783-aac36b8efe06","vulnerability":{"id":"CVE-2026-59876","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.","datePublished":"Jul 8, 2026, 3:31:11 PM","dateUpdated":"Jul 9, 2026, 2:41:45 PM","status":"PUBLISHED","baseScore":4.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934\nhttps://github.com/protobufjs/protobuf.js/pull/2335\nhttps://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8\nhttps://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5\n","enisa_id":"EUVD-2026-42311\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"00292018-87d6-3415-a4c1-48ea3d3fbda2","product":{"name":"protobuf.js","vendor":{"name":"protobufjs"}},"product_version":"8.2.0, \u003c 8.6.5"}],"vulnerabilityVendor":[{"id":"e9346d42-8124-3071-a919-2bf37ab94154","vendor":{"name":"protobufjs"}}]}},{"id":"6dc325bc-4fa8-331e-96c5-e3a6557930b7","vulnerability":{"id":"GHSA-jfj6-75fj-8934","description":"protobufjs: Text Format string map parsing can mutate returned map object prototype","datePublished":"Jul 20, 2026, 10:04:07 PM","dateUpdated":"Jul 20, 2026, 10:04:07 PM","baseScore":0.0,"references":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59876\nhttps://github.com/protobufjs/protobuf.js/pull/2335\nhttps://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8\nhttps://github.com/protobufjs/protobuf.js\nhttps://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5\n","enisa_id":"EUVD-2026-42311\n","aliases":"CVE-2026-59876\nGHSA-jfj6-75fj-8934\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}