CVE-2026-44288
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.30%
- CWE
- CWE-176
- Published
- 2026-05-13
- Last modified
- 2026-05-13
Affected products
- protobufjs protobuf.js
- protobufjs protobuf.js
Weakness type
Related vulnerabilities
- CVE-2026-14978 — Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
- CVE-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- CVE-2026-48618 — A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...
- CVE-2026-45135 — Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-45062 — FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
- CVE-2025-71316 — SQLite sqldiff remote code execution via argument injection
- CVE-2026-7040 — Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters