Bug 2498129 (CVE-2026-59876)

Summary: CVE-2026-59876 protobufjs: protobufjs: Prototype pollution vulnerability in Text Format extension
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, abuckta, alizardo, amctagga, aoconnor, bbrownin, bniver, cdrage, cmah, dkuc, dschmidt, eaguilar, ebaron, flucifre, gmeno, groman, jchui, jhe, jlanda, jmatsuok, jolong, jtolenti, kaycoth, kshier, ktsao, lchilton, manissin, mbenjamin, mhackett, mstipich, nboldt, oaljalju, orabin, pjindal, psrna, rexwhite, rhel-process-autobot, rushinde, sfeifer, simaishi, sostapov, stcannon, sthirugn, teagle, vereddy, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in protobufjs. The Text Format extension, responsible for compiling protobuf definitions into JavaScript functions, improperly parsed string-keyed map entries. This allowed a specially crafted map entry with the key `__proto__` to modify the prototype of the returned map object. An attacker could exploit this to alter object behavior, potentially leading to information disclosure or other impacts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-08 16:02:24 UTC 
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.