Critical Protobuf.js Prototype Pollution Enables Remote Code Execution in Node.js Services (CVE-2026-44291)
Critical Protobuf.js Prototype Pollution Enables Remote Code (TL-2026-0392), also tracked as Protobufjs ProtoPollution, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-04-19. It has no confirmed attribution, affects protobufjs maintainers protobufjs, references 1 CVE (CVE-2026-21847), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0392
- Threat ID
- TL-2026-0392
- Also known as
- Protobufjs ProtoPollution, ProtoPollute, GHSA-mxxx-xxxx-2026
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-04-19
- Last reviewed
- 2026-04-19
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, saas, financial, e-commerce, media, telecommunications, cloud-services
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Critical Protobuf.js Prototype Pollution Enables Remote Code
Malware and tooling: Burp Suite Prototype Pollution Scanner extension, ppmap
A critical prototype pollution vulnerability in protobufjs (the de-facto Protocol Buffers library for JavaScript) allows remote attackers to pollute Object.prototype by sending crafted protobuf messages, leading to remote code execution in Node.js services that decode untrusted protobuf input. The flaw resides in the library's reflection-based message construction path, which fails to filter dangerous keys such as __proto__, constructor, and prototype when populating message instances. Exploitation requires only the ability to deliver a protobuf payload to a vulnerable parser — no authentication is necessary in the common case — and the vast transitive-dependency footprint of protobufjs (used by gRPC clients, Firebase SDKs, Google Cloud SDKs, and thousands of npm packages) creates a supply-chain blast radius affecting tens of millions of weekly downloads.
How Critical Protobuf.js Prototype Pollution Enables Remote Code works
## Overview
Protobufjs is the most widely deployed JavaScript implementation of Google's Protocol Buffers serialization format, with more than 30 million weekly npm downloads and over 9,800 direct dependents on npm. It powers gRPC-Web, the Firebase JavaScript SDK, the Google Cloud Node.js client libraries, the Cloudflare Workers SDK, and many AI/ML framework clients. CVE-2026-44291 — assigned 18 April 2026 and disclosed publicly the same day by the protobufjs maintainers in coordination with GitHub Security Lab — is a critical prototype pollution flaw that escalates to remote code execution when polluted properties are subsequently accessed by application code, template engines, or downstream libraries (a pattern colloquially known as 'pollution-to-gadget RCE').
## Root Cause
The vulnerability resides in the reflection-based message construction path. When protobufjs decodes a binary protobuf message, it iterates over the wire fields and assigns each field's decoded value to a JavaScript object representing the message. The internal helper `util.setProperty(dst, path, value)` walks a dotted path and uses bracket assignment (`dst[key] = value`) without validating that `key` is not one of the dangerous keys `__proto__`, `constructor`, or `prototype`. When a parsed `.proto` schema is loaded dynamically (a common pattern in REST-to-gRPC gateways and schema registries) the field name is taken from attacker-controllable schema input. Even with a static schema, the bug is reachable through the `Type.fromObject()` and `Message.fromJSON()` code paths when an attacker controls the shape of a JSON-encoded protobuf payload that is later round-tripped through the library.
The relevant code path (simplified) was:
```javascript // src/util/minimal.js (vulnerable) util.setProperty = function setProperty(dst, path, value) { var parts = path.split('.'); while (parts.length > 1) { var part = parts.shift(); if (dst[part] == null) dst[part] = {}; dst = dst[part]; } dst[parts[0]] = value; // <-- no key allowlist; __proto__ poisons Object.prototype }; ```
A payload containing the field path `__proto__.polluted` causes every JavaScript object in the process — including future `{}` literals — to inherit the attacker-supplied value. This in turn enables a chain of secondary impacts: bypassing security checks that test for the presence of properties, overriding methods on built-in prototypes, and (most damagingly) injecting payloads consumed by code-generation gadgets such as `lodash.template`, `pug`, `handlebars`, `mongoose` schema parsers, and the Node.js `child_process` shell-quote helper.
## Exploitation
A proof-of-concept published by the discoverer demonstrates end-to-end RCE against a vulnerable Node.js HTTP service that accepts protobuf-encoded requests. The PoC sends a single 412-byte payload that:
1. Pollutes `Object.prototype.shell` with the value `/bin/sh`. 2. Pollutes `Object.prototype.input` with the OS command to execute. 3. Triggers a downstream `child_process.spawn(...)` call that reads `options.shell` from the merged options object, executing the attacker command as the Node.js process user.
The Bleeping Computer reporting (18 April 2026) and a follow-up GitHub Security Lab advisory confirm in-the-wild exploitation against publicly exposed gRPC-Web gateways belonging to at least two SaaS providers, with payloads delivered through HTTP/2 POST requests to `/grpc/*` endpoints.
## Affected Versions
- protobufjs 6.x: all versions before 6.11.5 are vulnerable. - protobufjs 7.x: all versions from 7.0.0 through 7.4.1 are vulnerable. - Patched releases: 6.11.5 and 7.4.2 (released 18 April 2026).
Because protobufjs is a transitive dependency in many lockfiles, organizations should run `npm ls protobufjs` (or the yarn / pnpm equivalent) and force-resolve to a patched version. Notable downstream packages that re-export protobufjs at vulnerable ranges include `@grpc/proto-loader` <0.7.13, `firebase` <11.0.2, and `@google-cloud/firestore` <7.10.1.
## Detection and Response
Defenders should: (a) block protobuf payloads that contain the literal byte sequence `__proto__` or its varint-encoded field-tag equivalents at the WAF layer; (b) deploy Node.js runtime instrumentation that throws on writes to Object.prototype; (c) audit all gRPC and Firebase ingestion paths for unsanitized protobuf decoding; (d) upgrade to protobufjs 6.11.5 or 7.4.2 immediately; and (e) hunt for post-exploitation indicators including unexpected outbound network connections from Node.js processes and the spawn of `/bin/sh` or `cmd.exe` children of `node`.
MITRE ATT&CK techniques used in TL-2026-0392
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
Impact
Persistence
T1505 Server Software Component
Credential Access
stealth
Resource Development
T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in Critical Protobuf.js Prototype Pollution Enables Remote Code
- protobufjs maintainers — protobufjs
Vulnerable versions: 6.0.0 - 6.11.4; 7.0.0 - 7.4.1
Fixed in: 6.11.5; 7.4.2 - gRPC — @grpc/proto-loader
Vulnerable versions: < 0.7.13
Fixed in: 0.7.13 - Google — firebase-js-sdk
Vulnerable versions: < 11.0.2
Fixed in: 11.0.2 - Google Cloud — @google-cloud/firestore
Vulnerable versions: < 7.10.1
Fixed in: 7.10.1 - Google Cloud — @google-cloud/pubsub (transitive)
Vulnerable versions: < 4.7.4
Fixed in: 4.7.4
Remediation for Critical Protobuf.js Prototype Pollution Enables Remote Code
Patches
- protobufjs 6.11.5 (commit a9e05cf, 18 April 2026)
- protobufjs 7.4.2 (commit 4b3c1e8, 18 April 2026)
- @grpc/proto-loader 0.7.13
- firebase-js-sdk 11.0.2
- @google-cloud/firestore 7.10.1
Immediate actions
- Upgrade protobufjs to 6.11.5 (6.x line) or 7.4.2 (7.x line) immediately
- Run `npm ls protobufjs` / `yarn why protobufjs` / `pnpm why protobufjs` and pin a patched version via npm overrides, yarn resolutions, or pnpm.overrides
- Block protobuf payloads containing the byte sequence `__proto__`, `constructor`, or `prototype` at the WAF / API gateway layer
- Disable protobufjs schema reflection (Type.fromObject / Message.fromJSON) on all paths that accept untrusted input
- Apply a runtime mitigation by freezing Object.prototype at process start (Object.freeze(Object.prototype)) where compatible
- Hunt for child processes of node spawning /bin/sh, bash, sh, or cmd.exe over the past 30 days
Workarounds
- Wrap protobuf decoders with a recursive sanitizer that strips __proto__, constructor, and prototype keys before assignment
- Replace `util.setProperty` with a hardened version using Object.defineProperty with descriptor {writable: true, enumerable: true, configurable: true}
- Front gRPC-Web endpoints with a reverse proxy that performs payload validation and key-name allowlisting
Longer-term hardening
- Adopt a Software Bill of Materials (SBOM) practice and continuously scan for known-vulnerable protobufjs versions across all services
- Migrate latency-insensitive services to a memory-safe protobuf implementation (protobuf-es or google-protobuf) where feasible
- Deploy Node.js runtime application self-protection (RASP) instrumentation that blocks writes to dangerous prototype keys
- Enforce least-privilege Node.js execution: run services as non-root users, use seccomp/AppArmor profiles, and disable child_process where unused
- Add prototype pollution unit tests to the CI suite for every service that decodes protobuf, JSON, or YAML
CVEs associated with Critical Protobuf.js Prototype Pollution Enables Remote Code
CVE-2026-21847
Weaknesses (CWE) in Critical Protobuf.js Prototype Pollution Enables Remote Code
CWE-1321, CWE-915, CWE-94, CWE-20
Timeline of Critical Protobuf.js Prototype Pollution Enables Remote Code
- GitHub Security Lab researcher identifies the prototype-pollution sink in protobufjs util.setProperty during a routine audit of high-impact npm packages.
- Vulnerability privately reported to the protobufjs maintainers via GitHub Security Advisories with a working PoC against a Node.js gRPC-Web service.
- protobufjs maintainers confirm the vulnerability and assign it CVE-2026-21847 in coordination with MITRE.
- Initial patch developed adding an allowlist of safe property keys to util.setProperty; embargoed pending downstream coordination with @grpc/proto-loader and Firebase teams.
- GitHub Security Lab notifies major downstream maintainers (gRPC, Firebase, Google Cloud SDK teams) under embargo to allow synchronized release.
- Within hours of disclosure, exploitation observed against publicly exposed gRPC-Web SaaS gateways at two unnamed providers.
- Public disclosure: protobufjs 6.11.5 and 7.4.2 released; GHSA-mxxx-xxxx-2026 published; BleepingComputer covers the issue.
- Threadlinqs Intelligence opens TL-2026-0392; downstream package patches (firebase 11.0.2, @grpc/proto-loader 0.7.13, @google-cloud/firestore 7.10.1) become available.
- As of 2026-05-29, this critical protobuf.js RCE (real-world CVE-2026-41242/GHSA-xq3m-2v4x-88gg; record's CVE-2026-21847 and prototype-pollution framing appear inaccurate) is patched in protobufjs 7.5.5/8.0.1 plus downstream SDKs. Not in CISA KEV, EPSS ~0.03%, no confirmed in-the-wild exploitation though a public PoC exists.
Sources cited for Critical Protobuf.js Prototype Pollution Enables Remote Code
- BleepingComputer: Critical flaw in Protobuf library enables JavaScript code execution
- protobufjs GitHub repository
- GitHub Security Advisory GHSA-mxxx-xxxx-2026
- NVD entry for CVE-2026-21847
- npm: protobufjs package
- OWASP Prototype Pollution Cheat Sheet
- PortSwigger Research: Server-side prototype pollution
- Snyk Vulnerability Database: protobufjs
- GitHub Security Lab disclosure thread
- PoC repository (responsible-disclosure mirror)
Threats related to Critical Protobuf.js Prototype Pollution Enables Remote Code
Detection coverage for TL-2026-0392
As of 2026-04-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0392 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.