Six RCE and DoS flaws found in protobuf.js for Node.js applications

Affected Systems

protobuf.js library (JavaScript/TypeScript implementation of Protocol Buffers) used in Node.js applications. Specific vulnerable versions not provided in summary. All applications using protobuf.js to parse untrusted schemas, descriptors, or payloads are potentially affected.

Exploitation Status

Vulnerabilities disclosed but no CVE assigned yet. Active exploitation status unknown. Attack vector requires attacker-controlled protobuf schema, descriptor, or crafted payload. Exploitation complexity appears moderate given single malicious input can trigger multiple vulnerabilities.

Business Impact

High severity. Remote code execution enables full system compromise in affected Node.js applications. DoS attacks can disrupt service availability. Applications that parse protobuf data from untrusted sources (APIs, user uploads, external integrations) face immediate risk. No CVE identifiers assigned yet, which may delay automated vulnerability scanning detection. Patch availability and affected version ranges not specified in disclosure.

Urgency

🟠 Within 24 hours

Recommended Actions

• Audit all Node.js applications for protobuf.js dependencies using npm ls protobuf or yarn why protobufjs
• Identify applications that parse protobuf schemas, descriptors, or messages from untrusted or external sources
• Monitor protobuf.js GitHub repository and npm package for security advisories and patched versions
• Implement input validation and sandboxing for any protobuf parsing operations handling untrusted data
• Consider temporary mitigations such as restricting protobuf parsing to trusted sources only until patches are available and applied