Improper Check for Unusual or Exceptional Conditions Affecting protobufjs-cli package, versions <1.3.3>=2.0.0 <2.5.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-PROTOBUFJSCLI-17353169
- published17 Jun 2026
- disclosed15 Jun 2026
- creditYoungjoon Kim
Introduced: 15 Jun 2026
NewCVE-2026-54269 (opens in a new tab)How to fix?
Upgrade protobufjs-cli to version 1.3.3, 2.5.1 or higher.
Overview
protobufjs-cli is a Translates between file formats and generates static code as well as TypeScript definitions.
Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the schema-derived names that collide with runtime-significant properties. An attacker can cause affected message or service types to become unusable, resulting in denial of service for the relevant processing path, by providing or influencing protobuf schemas or JSON descriptors containing problematic names such as hasOwnProperty, $type, or rpcCall.
Workaround
This vulnerability can be mitigated by not loading protobuf schemas or JSON descriptors from untrusted sources, or by validating and rejecting schema-derived field, oneof, and service method names that match the problematic names before loading.