CVE-2026-59876

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59876
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59876.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59876
Aliases
Downstream
CGA (22)
CLEANSTART (2)
MINI (1)
Published
2026-07-08T15:31:11Z
Modified
2026-10-15T10:52:23Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
protobufjs: Text Format string map parsing can mutate returned map object prototype
Details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59876.json"
}
References

Affected packages

Git / github.com/protobufjs/protobuf.js

Affected ranges

Type
GIT
Repo
https://github.com/protobufjs/protobuf.js
Events
Introduced
f8d5f3fe7104fade45407341228f0f0bb623e76d
Fixed
3f7b2fa2dd679f7099a30098a75bcd776615e86f
Fixed
9f97fe413072d3beb52c74e62d88ea8adc9444d8
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "fixed": "8.6.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "9f97fe413072d3beb52c74e62d88ea8adc9444d8"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "protobufjs-v8.6.5",
            "range": [
                {
                    "fixed": "3f7b2fa2dd679f7099a30098a75bcd776615e86f"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

protobufjs-cli-v2.*
protobufjs-cli-v2.2.0
protobufjs-cli-v2.2.1
protobufjs-cli-v2.3.0
protobufjs-cli-v2.4.0
protobufjs-cli-v2.4.1
protobufjs-cli-v2.4.2
protobufjs-cli-v2.5.0
protobufjs-cli-v2.5.1
protobufjs-cli-v2.5.2
protobufjs-cli-v2.5.3
protobufjs-cli-v2.5.4
protobufjs-cli-v2.5.5
protobufjs-v8.*
protobufjs-v8.2.0
protobufjs-v8.2.1
protobufjs-v8.3.0
protobufjs-v8.4.0
protobufjs-v8.4.1
protobufjs-v8.4.2
protobufjs-v8.5.0
protobufjs-v8.6.0
protobufjs-v8.6.1
protobufjs-v8.6.2
protobufjs-v8.6.3
protobufjs-v8.6.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59876.json"