protobufjs@6.10.2 vulnerabilities

Protocol Buffers for JavaScript (& TypeScript).

Direct Vulnerabilities

Known vulnerabilities in the protobufjs package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Prototype Pollution

protobufjs is a protocol buffer for JavaScript (& TypeScript).

Affected versions of this package are vulnerable to Prototype Pollution. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve:

  1. using the function parse to parse protobuf messages on the fly,

  2. loading .proto files by using load/loadSync functions, or

  3. providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty

Note: This is a different issue from CVE-2022-25878

How to fix Prototype Pollution?

Upgrade protobufjs to version 6.11.4, 7.2.4 or higher.

>=6.10.0 <6.11.4 >=7.2.0 <7.2.4
  • H
Prototype Pollution

protobufjs is a protocol buffer for JavaScript (& TypeScript).

Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

This vulnerability can occur in multiple ways:

  1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
  2. by parsing/loading .proto files

How to fix Prototype Pollution?

Upgrade protobufjs to version 6.10.3, 6.11.3 or higher.

>=6.10.0 <6.10.3 >=6.11.0 <6.11.3