Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Summary: Cyera researchers identified six vulnerabilities in protobuf.js, codenamed Proto6, that can lead to remote code execution and denial-of-service in Node.js applications, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. The flaws stem from the library treating schema and metadata as trusted by default, with the most severe, CVE-2026-44291, enabling code execution through prototype pollution that feeds an attacker-controlled string into a generated encoder or decoder compiled with Function().
Bottom line: A single malicious protobuf schema or crafted payload can be enough to trigger crashes or code execution, and protobuf.js sits inside databases, vector stores, inference pipelines, orchestration systems, and cloud SDKs - so the trust assumption that schemas and config files are safe inputs is now an attack surface across AI and enterprise workloads at scale.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Mentions
- CVE-2026-44291CVE-2026-44292CVE-2026-44295
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026