Cybersecurity researchers have flagged half a dozen vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers, that could lead to remote code execution (RCE) and denial-of-service (DoS) attacks. The flaws, collectively tracked as Proto6, reside in how the library processes protobuf schemas, descriptors, and crafted payloads.
The vulnerabilities affect applications using vulnerable versions of protobuf.js, particularly in Node.js environments that parse untrusted protobuf data. While specific CVSS scores and affected version ranges were not detailed in the disclosure, the potential for full system compromise elevates the severity. Evidence of active exploitation in the wild has not yet been confirmed.
Attack vectors involve sending a single malicious protobuf schema, descriptor, or specially crafted payload to an affected application. Successful exploitation could allow attackers to execute arbitrary code remotely or crash the service, leading to denial of service. No specific indicators of compromise were shared publicly at this time.
Mitigation guidance urges developers to update protobuf.js to the latest patched version immediately. Until a fix can be applied, limiting exposure by restricting access to untrusted protobuf inputs and employing input validation may reduce risk. The researchers did not specify a timeline for when patches were issued.
Attribution for the discovery was not named in the source material. However, the disclosure adds to a growing list of serialization library vulnerabilities — similar to issues in Apache Avro and MessagePack — that underscore the risks of handling untrusted data in performance-critical environments.