protobufjs@8.0.1

• 11 known advisories (worst: high), fixed in 8.6.6.Evidence

Confidence 100% · algorithm v1 · computed 2026-11-06. How verdicts work

Malware reports

None known (OSV)

Known advisories

11 known

License

BSD-3-Clause

Install scripts

Runs scripts on install

Build provenance

No provenance

Weekly downloads

1,730,793

• moderateGHSA-2pr8-phx7-x9h3protobuf.js: Denial of service from crafted field names in generated code
• highGHSA-66ff-xgx4-vchmprotobuf.js: Code injection through bytes field defaults in generated toObject code
• highGHSA-685m-2w69-288qprotobuf.js: Denial of service through unbounded protobuf recursion
• highGHSA-75px-5xx7-5xc7protobuf.js: Code generation gadget after prototype pollution
• moderateGHSA-f38q-mgvj-vph7protobufjs : Schema-derived names can shadow runtime-significant properties
• moderateGHSA-fx83-v9x8-x52wprotobuf.js: Prototype injection in generated message constructors
• moderateGHSA-j3f2-48v5-ccwwprotobufjs: Denial of Service via infinite loop in .proto option parsing
• moderateGHSA-jggg-4jg4-v7c6protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
• highGHSA-jvwf-75h9-cwggprotobuf.js: Process-wide denial of service through unsafe option paths
• moderateGHSA-q6x5-8v7m-xcrfprotobufjs has overlong UTF-8 decoding

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

Check the official release notes below for behaviour changes before merging.

Read the package page on npm for this version’s features and fixes.

The maintainer has not deprecated this version on npm.