Receive daily AI-curated summaries of engineering articles from top tech companies worldwide.

The Hacker News

|Security

Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

2026-06-10

1 min read

by info@thehackernews.com (The Hacker News)

Six vulnerabilities in protobuf.js expose Node.js applications to RCE and DoS attacks.

•CVE-2026-44291 (CVSS 8.7) enables code execution via prototype pollution and Function() compilation
•Other DoS flaws: unbounded recursion (CVE-2026-44289) and unsafe schema paths (CVE-2026-44290)
•Affected: protobuf.js <= 7.5.5, 8.0.0-8.0.1; patches in 7.5.6, 8.0.2
•Root cause: schemas treated as trusted without validation
•Impacts Node.js services, Google Cloud, CI/CD pipelines, and Baileys messaging framework

This summary was automatically generated by AI based on the original article and may not be fully accurate.

Related Articles