protobufjs: Code injection through bytes field defaults in generated toObject code

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-44293 · CVE overview and exploitation status

EUVD-2026-30031

GHSA-66ff-xgx4-vchm

cve-program · CVE-2026-44293

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm

euvd · EUVD-2026-30031

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm

nvd · CVE-2026-44293

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm
• https://access.redhat.com/errata/RHSA-2026:26090
• https://access.redhat.com/errata/RHSA-2026:26234
• https://access.redhat.com/errata/RHSA-2026:29795
• https://access.redhat.com/errata/RHSA-2026:34160
• https://access.redhat.com/errata/RHSA-2026:34374
• https://access.redhat.com/errata/RHSA-2026:37186
• https://access.redhat.com/errata/RHSA-2026:37385
• https://access.redhat.com/errata/RHSA-2026:37628
• https://access.redhat.com/errata/RHSA-2026:54555
• https://access.redhat.com/errata/RHSA-2026:57487
• https://access.redhat.com/errata/RHSA-2026:60520
• https://access.redhat.com/security/cve/CVE-2026-44293
• https://bugzilla.redhat.com/show_bug.cgi?id=2477104
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44293.json

osv · GHSA-66ff-xgx4-vchm

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm
• https://github.com/protobufjs/protobuf.js
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2

No related changes are available here.