REDHAT-BUG-2477111: High severity protobufjs vulnerability
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477111?
The severity of REDHAT-BUG-2477111 is high, rated at 7.
How do I fix REDHAT-BUG-2477111?
To address REDHAT-BUG-2477111, update to protobufjs version 7.5.6 or later, or 8.0.2 or later.
What does REDHAT-BUG-2477111 affect?
REDHAT-BUG-2477111 affects the protobufjs library, which compiles protobuf definitions into JavaScript functions.
What is the risk associated with REDHAT-BUG-2477111?
The risk associated with REDHAT-BUG-2477111 is rated at 33, indicating a significant potential impact.
When was REDHAT-BUG-2477111 published?
REDHAT-BUG-2477111 was published on May 13, 2026.