Summary

The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry.

This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected.

Impact

An attacker who can provide protobuf text-format input parsed by an application using protobufjs/ext/textformat may be able to create message objects whose string-keyed map fields have attacker-controlled prototypes.

This is per-object prototype mutation, not global Object.prototype pollution. Impact depends on downstream application logic treating inherited properties as meaningful, for example by using in, truthiness checks, or direct property access on parsed map objects instead of own-property checks.

Applications that do not parse untrusted Text Format input, or that do not use inherited properties from parsed map objects in security-relevant logic, are not directly affected.

Preconditions

The application must parse attacker-controlled protobuf Text Format input with protobufjs/ext/textformat. The target schema must contain a string-keyed map field. The crafted input must provide a map entry with key proto. Downstream application logic must treat inherited properties on the returned map object as meaningful for impact beyond malformed output.

Workarounds

Upgrade to protobufjs 8.6.5 or newer.

If immediate upgrade is not possible, do not parse untrusted protobuf Text Format input with affected versions. Applications can also reject string map keys named proto before or during Text Format parsing, and should use own-property checks such as Object.hasOwnProperty.call(map, key) when consuming parsed map objects.

Summary

protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them.

A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into.

Impact

An attacker who can provide protobuf binary data decoded by an application using affected protobufjs versions may be able to increase memory pressure by sending messages with many unknown fields. This can degrade availability or contribute to process termination in services that decode and retain attacker-controlled messages.

This issue affects applications that decode untrusted protobuf binary input and do not need unknown-field round-tripping. Applications that only decode trusted protobuf data, already enforce input-size/concurrency limits, or do not retain decoded messages beyond immediate processing are less directly affected.

Preconditions

The application must decode protobuf binary data influenced by an attacker. The decoded schema must not define the attacker-selected field numbers, causing those fields to be treated as unknown. The application must use a protobufjs version that preserves unknown fields but does not provide a decode-time discard option. The decoded message, or enough decoded messages concurrently, must remain live long enough for retained unknown-field data to affect memory usage.

Workarounds

Upgrade to protobufjs 8.5.0 or newer and disable unknown-field preservation if not needed: Create a Reader, set reader.discardUnknown = true, and decode from that reader, or make this the default for subsequently created readers by setting Reader.discardUnknown = true. When upgrading to protobufjs 8.6.2 or newer, unknown fields are discarded by default unless opted into by setting discardUnknown = false.

Applications should also continue to enforce input-size, request concurrency, and request timeout limits at their transport or application boundary.