protobufjs Prototype Pollution Vulnerability Advisory and Mitigation

Critical Vulnerability Information Vulnerability Type Prototype Pollution Affected Scope Affected versions of package: >=6.10.0 =6.11.0 <6.11.3 Remediation Recommendation Upgrade to version 6.10.3, 6.11.3, or higher. Vulnerability Overview is a protocol buffer implementation for JavaScript (& TypeScript). Affected versions contain a Prototype Pollution vulnerability, allowing attackers to add or modify properties on . The vulnerability can be triggered in multiple ways: 1. By providing untrusted user input to or functions. 2. By parsing/loading files. Vulnerability Severity CVSS Score: 8.2 (High) Threat Intelligence Exploit Maturity: Proof-of-Concept EPSS: 0.39% (60th percentile) Vulnerability Details Prototype Pollution is a vulnerability affecting JavaScript, enabling injection of properties into existing JavaScript object prototypes. Attackers exploit this by manipulating properties. Two primary methods of prototype pollution exist: unsafe recursive object merging and path-based property definition. Attack Types Denial of Service (DoS) Remote Code Execution Property Injection Affected Environments Application Servers Web Servers Web Browsers Preventive Measures 1. Freeze the prototype — use . 2. Enforce JSON input schema validation. 3. Avoid using unsafe recursive merge functions. 4. Consider using objects without prototypes (e.g., ) to break the prototype chain and prevent pollution. 5. Prefer using Map over Object where possible.

Goal Reached Thanks to every supporter — we hit 100%!

protobufjs Prototype Pollution Vulnerability Advisory and Mitigation