Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T15:31:11 protobufjs: protobufjs: Prototype pollution vulnerability in Text Format extension 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-915

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

A flaw was found in protobufjs. The Text Format extension, responsible for compiling protobuf definitions into JavaScript functions, improperly parsed string-keyed map entries. This allowed a specially crafted map entry with the key `__proto__` to modify the prototype of the returned map object. An attacker could exploit this to alter object behavior, potentially leading to information disclosure or other impacts.

This Moderate-impact flaw in protobufjs allows an attacker to perform prototype pollution by providing specially crafted input to the Text Format extension. This could lead to information disclosure or other impacts by altering the behavior of JavaScript objects within applications utilizing protobufjs to process protobuf definitions. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Cryostat 4 Under investigation grafana-infinity-datasource-npm OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Under investigation automation-platform-ui Red Hat Build of Podman Desktop Under investigation rh-podman-desktop.git Red Hat Ceph Storage 9 Under investigation rhceph/alloy-rhel10 Red Hat Developer Hub Not affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 8 Under investigation grafana Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected dotnet9.0 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/mcg-core-rhel9 Self-service automation portal 2 Not affected ansible-automation-platform/automation-portal Self-service automation portal 2 Not affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59876 https://nvd.nist.gov/vuln/detail/CVE-2026-59876 https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8 https://github.com/protobufjs/protobuf.js/pull/2335 https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5 https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934