Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

Cybersecurity researchers have disclosed six vulnerabilities in protobuf.js — the JavaScript and TypeScript implementation of Google's Protocol Buffers (Protobuf) serialization format — that can be chained or exploited independently to achieve remote code execution (RCE) and denial-of-service (DoS) attacks against applications that process attacker-controlled protobuf data.

The vulnerabilities, collectively dubbed Proto6, affect the widely-used protobufjs npm package and its TypeScript counterpart, which together accumulate tens of millions of downloads per week across the npm ecosystem.

What Is protobuf.js?

Protocol Buffers (Protobuf) is Google's binary serialization format, used extensively in gRPC microservices, API communication, and data storage pipelines. protobuf.js is the de facto JavaScript/TypeScript implementation, enabling Node.js and browser applications to serialize and deserialize Protobuf messages.

The library's wide adoption — particularly in backend Node.js microservices and gRPC-based APIs — makes these vulnerabilities high-impact for organizations running modern cloud-native architectures.

The Proto6 Vulnerabilities

Researchers identified six distinct flaws across different components of the protobuf.js message parsing and decoding pipeline:

Prototype Pollution → RCE

The most severe of the six flaws involves prototype pollution through carefully crafted Protobuf field names. An attacker can embed field names like __proto__ or constructor in a serialized Protobuf message, which — when decoded by the vulnerable library — modifies JavaScript's global object prototype. This can be escalated to RCE by poisoning built-in methods used by the application.

// Attacker-crafted protobuf message (conceptual)
// Field name "__proto__.toString" with malicious payload
// → pollutes Object.prototype.toString
// → RCE when application calls toString() in a privileged context

Unsafe eval() Codepath

A second RCE vector exists in protobuf.js's dynamic message generation feature, which uses eval() to build optimized decoder functions from schema definitions. When schema content is partially user-influenced (e.g., when loading .proto files from user-supplied paths), this path enables arbitrary code execution.

Recursion DoS

All six flaws include a denial-of-service impact pathway. The unchecked recursion vulnerability is particularly severe: an attacker can craft a Protobuf message containing circular or deeply nested references that cause the decoder to exhaust the Node.js call stack, crashing the process.

Affected Versions

Patches are expected for the protobufjs npm package. Organizations should:

1. Check their package.json and package-lock.json for protobufjs as a direct or transitive dependency
2. Monitor the protobufjs npm page and GitHub releases for patched versions
3. Apply updates as soon as they are available

# Check if protobufjs is in your dependency tree
npm ls protobufjs
 
# Or with yarn
yarn list --pattern protobufjs
 
# Or check for all versions in node_modules
find node_modules -name "package.json" -path "*/protobufjs/*" | xargs grep '"version"'

Who Is at Risk?

Any Node.js application that:

• Processes Protobuf messages from untrusted sources (user-submitted data, external API responses, file uploads)
• Uses gRPC with protobuf.js on the server side
• Loads .proto schemas dynamically from user-influenced paths
• Has protobufjs in its dependency tree (direct or transitive via gRPC libraries)

Applications that only process Protobuf from fully trusted internal sources have a lower risk profile, but all deployments should patch.

Immediate Mitigation

Until an official patch is available:

1. Validate and sanitize all incoming Protobuf data before passing it to the parser
2. Avoid loading .proto schema files from user-controlled paths
3. Disable dynamic message generation if your application can use pre-compiled static decoders
4. Monitor for prototype pollution indicators — unexpected modifications to Object.prototype or Function.prototype
5. Implement process-level isolation for services that handle untrusted Protobuf input (containers, separate worker processes with limited privileges)

Broader Supply Chain Context

This disclosure arrives during an ongoing period of heightened npm supply chain scrutiny. protobuf.js is a transitive dependency in hundreds of popular Node.js packages — including widely-used gRPC client libraries — meaning applications that don't directly depend on it may still be affected through indirect dependency chains.

# Audit your full dependency tree for exposure
npm audit
npx better-npm-audit audit
 
# For gRPC users, check @grpc/proto-loader which wraps protobufjs
npm ls @grpc/proto-loader

Organizations using software composition analysis (SCA) tools like Snyk, Socket, or Dependabot should expect alerts once CVEs are formally assigned to the Proto6 set of vulnerabilities.

References

• The Hacker News: Six Proto6 Vulnerabilities in protobuf.js
• npm: protobufjs
• protobuf.js GitHub Repository
• OWASP: Prototype Pollution