Threat Intelligence / CVE / CVE-2026-44291

CVE-2026-44291

CVSS 8.1 (HIGH) · EPSS 0.0% · Priority 4.4/10 · Published 2026-05-13

As of 2026-05-13, CVE-2026-44291 is a CVSS 8.1 (HIGH-severity) vulnerability. EPSS exploitation probability 0.0%. Threadlinqs Intelligence tracks 0 threats exploiting it.

Last updated: 2026-05-13

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.

CVSS v3 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

References

Full detection coverage & IOCs for threats exploiting CVE-2026-44291 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.