CVE-2026-54269: Runtime Property Shadowing and Denial of Service in protobufjs

The protobufjs library is a widely deployed JavaScript and TypeScript parser designed to handle Protocol Buffers. In standard implementations, the engine translates structured schema definitions into optimized runtime objects. This process involves dynamically compiling schemas into executable code paths to achieve high-performance serialization, deserialization, and validation operations.

The vulnerability, designated as CVE-2026-54269 (and tracked via GHSA-f38q-mgvj-vph7), stems from an unsafe assumption during this dynamic compilation phase. The compiler assumes that the field names defined in arbitrary user-supplied schemas will never collide with critical built-in methods or library properties. When a schema contains specific runtime-significant names, these identifiers shadow the underlying system properties.

This flaw exposes applications to unhandled exceptions and infinite loops, causing immediate runtime execution failures. The impact is particularly high for environments parsing untrusted schemas, multi-tenant registries, or microservice gateways that ingest external configurations dynamically.

The root cause of this vulnerability lies in how dynamically compiled JavaScript code interacts with standard prototypical inheritance. During schema processing, the library generates helper functions using string concatenation and compiles them via the Function constructor. When validating or converting objects, the generated methods check for field presence by evaluating expressions directly on the message instance, such as message.hasOwnProperty(fieldName).

If an untrusted schema contains a field explicitly named hasOwnProperty, the instantiated object is created with an own-property of the same name. Since native JavaScript objects resolve properties on the instance before traversing the prototype chain, the schema-derived property overrides the native Object.prototype.hasOwnProperty method. When the compiled validation logic subsequently executes, it attempts to call this shadowed property as a function, resulting in a type mismatch error.

In addition to property validation, service-level RPC bindings are vulnerable to helper method shadowing. When a service defines an RPC method named rpcCall, this identifier overrides the internal prototype method designed to orchestrate remote procedures. Invoking this service wrapper triggers an unintended self-referential call sequence, yielding uncontrolled recursion (CWE-674) and terminating the thread with a stack overflow.

Finally, metadata management is disrupted by field names starting with a dollar sign. The library relies on properties such as $type to manage serialization metadata. When schema-controlled structures define conflicting properties, the type resolution mappings break down, leading to structural failures during JSON serialization and translation.

To understand the vulnerability and its remediation, we examine the compilation differences introduced in patch version 7.6.3.

Prior to the patch, the validator generator in src/verifier.js generated conditional checks using direct instance invocation:

// Vulnerable logic generation pattern
if (message.field != null && message.hasOwnProperty("field")) {
    // Validation logic execution
}

If the field hasOwnProperty was present on the message instance, this check threw a TypeError: message.hasOwnProperty is not a function. The patch in PR #2311 resolved this by forcing execution to bypass local overrides through the native prototype method:

// Patched logic generation pattern
if (message.field != null && Object.hasOwnProperty.call(message, "field")) {
    // Safe validation execution
}

Similar changes were implemented across other codegen paths including src/converter.js and src/decoder.js to eliminate all instance-direct calls.

For service generation in src/service.js, the original implementation assigned method handlers that assumed this.rpcCall was the safe helper:

// Vulnerable wrapper assignment
rpcService[methodName] = util.codegen(["r","c"], methodName)("return this.rpcCall(m,q,s,r,c)");

When methodName was equal to rpcCall, executing the method caused the function to endlessly call itself. The patched implementation utilizes an explicit closure to bind and call the prototype method securely:

// Patched service wrapper assignment
rpcService[methodName] = (function(method, requestType, responseType) {
    return function rpcMethod(request, callback) {
        return rpc.Service.prototype.rpcCall.call(this, method, requestType, responseType, request, callback);
    };
})(method, method.resolvedRequestType.ctor, method.resolvedResponseType.ctor);

An attacker can exploit this vulnerability by submitting a malformed Protocol Buffer schema designed to shadow runtime-critical properties. The following diagram illustrates the flow from schema submission to process termination:

To construct a proof of concept, an attacker crafts a .proto file that specifies a message structure where a field conflicts with native properties:

syntax = "proto3";
 
message ExploitPayload {
    string hasOwnProperty = 1;
    string standardField = 2;
}

When the system receives and processes this schema, it evaluates the compilation definitions dynamically. If the application subsequently executes ExploitPayload.verify(incomingData) or ExploitPayload.toObject(message), the validation routine attempts to run the overridden method.

Because the value assigned to message.hasOwnProperty is a string (representing the data payload) and not a callable function, the execution halts immediately. Since JavaScript environments are single-threaded, an uncaught exception in the main loop terminates the host process.

The practical impact of CVE-2026-54269 is limited to Denial of Service (DoS) conditions. Because the vulnerability does not bypass access control parameters, it cannot be leveraged to execute arbitrary shellcode or read sensitive data from the system memory space directly.

However, in Node.js architectures, process termination represents a high operational risk. If the target application lacks robust orchestrators (such as Kubernetes pods or PM2 process managers), a single malformed payload can permanently take down the service instance. Even with active process managers, continuous exploitation can trigger crash-loop backoffs, exhausting server resources.

The CVSS v3.1 rating is 5.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. This score reflects that while the execution barrier is low and requires no administrative privileges, the overall scope remains isolated to the affected component.

To fully remediate CVE-2026-54269, development teams must update the affected dependencies across all service boundaries. For deployments using the 7.x release stream, update protobufjs to version 7.6.3 or later. For services on the 8.x branch, transition to 8.6.0 or higher. Applications compiling schemas statically must also update protobufjs-cli to versions 1.3.3 or 2.5.1 respectively, and regenerate all static assets.

If patching cannot be executed immediately, apply input validation filters to the schema ingestion path. Block any schemas that define properties named hasOwnProperty or declare service actions named rpcCall.

Additionally, implement validation rules to reject any fields or object definitions that begin with the dollar sign character ($). This configuration prevents attackers from corrupting internal metadata parameters and protects the execution integrity of json-to-protobuf translation utilities.