Bug 2498129 (CVE-2026-59876) - CVE-2026-59876 protobufjs: protobufjs: Prototype pollution vulnerability in Text Format extension
Summary: CVE-2026-59876 protobufjs: protobufjs: Prototype pollution vulnerability in T...
Keywords:
Status: NEW
Alias: CVE-2026-59876
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-08 16:02 UTC by OSIDB Bzimport
Modified: 2026-08-11 16:21 UTC (History)
48 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-08 16:02:24 UTC 
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
Comment 4 Yadnyawalk Tale 2026-08-11 16:21:39 UTC 
CVE targets protobufjs npm 8.2.0–8.6.4 Text Format extension only. Fedora packages here don't ship that library/version.
Note You need to log in before you can comment on or make changes to this bug.