Critical Protobuf.js Prototype Pollution Enables Remote Code Execution in Node.js Services (CVE-2026-44291) — Threadlinqs Intelligence
As of 2026-06-14, Critical Protobuf.js Prototype Pollution Enables Remote Code Execution in Node.js Services (CVE-2026-44291) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0392 · Severity: CRITICAL · CVSS: 9.4 · Status: PATCHED · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
A critical prototype pollution vulnerability in protobufjs (the de-facto Protocol Buffers library for JavaScript) allows remote attackers to pollute Object.prototype by sending crafted protobuf
## Overview
Protobufjs is the most widely deployed JavaScript implementation of Google's Protocol Buffers serialization format, with more than 30 million weekly npm downloads and over 9,800 direct dependents on npm. It powers gRPC-Web, the Firebase JavaScript SDK, the Google Cloud Node.js client libraries, the Cloudflare Workers SDK, and many AI/ML framework clients. CVE-2026-44291 — assigned 18 April 2026 and disclosed publicly the same day by the protobufjs maintainers in coordination with GitHub Security Lab — is a critical prototype pollution flaw that escalates to remote code execution when polluted properties are subsequently accessed by application code, template engines, or downstream libraries (a pattern colloquially known as 'pollution-to-gadget RCE').
## Root Cause
The vulnerability resides in the reflection-based message construction path. When protobufjs decodes a binary protobuf message, it iterates over the wire fields and assigns each field's decoded value to a JavaScript object representing the message. The internal helper `util.setProperty(dst, path, value)` walks a dotted path and uses bracket assignment (`dst[key] = value`) without validating that `key` is not one of the dangerous keys `__proto__`, `constructor`, or `prototype`. When a parsed `.proto` schema is loaded dynamically (a common pattern in REST-to-gRPC gateways and schema registries) the field name is taken from attacker-controllable schema input. Even with a static schema, the bug is reachable through the `Type.fromObject()` and `Message.fromJSON()` code paths when an attacker controls the shape of a JSON-encoded protobuf payload that is later round-tripped through the library.
The relevant code path (simplified) was:
```javascript
// src/util/minimal.js (vulnerable)
util.setProperty = function setProperty(dst, path, value) {
var parts = path.split('.');
while (parts.length > 1) {
var part = parts.shift();
if (dst[part] == null) dst[part] = {};
dst = dst[part];
}
dst[parts[0]] = value; // <-- no key allowlist; __proto__ poisons Object.prototype
};
```
A payload containing the field path `__proto__.polluted` causes every JavaScript object in the process — including future `{}` literals — to inherit the attacker-supplied value. This in turn enables a chain of secondary impacts: bypassing security checks that test for the presence of properties, overriding methods on built-in prototypes, and (most damagingly) injecting payloads consumed by code-generation gadgets such as `lodash.template`, `pug`, `handlebars`, `mongoose` schema parsers, and the Node.js `child_process` shell-quote helper.
## Exploitation
A proof-of-concept published by the discoverer demonstrates end-to-end RCE against a vulnerable Node.js HTTP service that accepts protobuf-encoded requests. The PoC sends a single 412-byte payload that:
1. Pollutes `Object.prototype.shell` with the value `/bin/sh`.
2. Pollutes `Object.prototype.input` with the OS command to execute.
3. Triggers a downstream `child_process.spawn(...)` call that reads `options.shell` from the merged options object, executing the attacker command as the Node.js process user.
The Bleeping Computer reporting (18 April 2026) and a follow-up GitHub Security Lab advisory confirm in-the-wild exploitation against publicly exposed gRPC-Web gateways belonging to at least two SaaS providers, with payloads delivered through HTTP/2 POST requests to `/grpc/*` endpoints.
## Affected Versions
- protobufjs 6.x: all versions before 6.11.5 are vulnerable.
- protobufjs 7.x: all versions from 7.0.0 through 7.4.1 are vulnerable.
- Patched releases: 6.11.5 and 7.4.2 (released 18 April 2026).
Because protobufjs is a transitive dependency in many lockfiles, organizations should run `npm ls protobufjs` (or the yarn / pnpm equivalent) and force-resolve to a patched version. Notable downstream packages that re-export protobufjs at vulnerable ranges include `@grpc/proto-loader` <0.7.13, `firebase` <11.0.2, and `
Weaknesses (CWE)
CWE-1321, CWE-915, CWE-94, CWE-20
Target sectors: technology, saas, financial, e-commerce, media, telecommunications, cloud-services
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-21847, T1596, T1595, T1587, T1608, T1190, T1195, T1195, T1059, T1059, T1203