Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

protobufjs has an arbitrary code execution issue

Fix availableCritical · CVSS 9.4EPSS 0.77%

Published Apr 16, 2026 · updated Nov 4, 2026

What to do

  1. Upgrade to a fixed version: protobufjs 8.0.1, protobufjs 7.5.5, protobufjs 6.11.6.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmprotobufjs122,238,629 downloads/week

Vulnerable versions
>= 8.0.0, < 8.0.1
Fixed in
8.0.1

Check your project: npm ls protobufjs --all

Is protobufjs@8.0.1 safe to install? See the upgrade verdict →

npmprotobufjs122,238,629 downloads/week

Vulnerable versions
>= 7.0.0, < 7.5.5
Fixed in
7.5.5

Check your project: npm ls protobufjs --all

Is protobufjs@7.5.5 safe to install? See the upgrade verdict →

npmprotobufjs122,238,629 downloads/week

Vulnerable versions
< 6.11.6
Fixed in
6.11.6

Check your project: npm ls protobufjs --all

Is protobufjs@6.11.6 safe to install? See the upgrade verdict →

Sources

CWE-94 Improper Control of Generation of Code

← All critical vulnerabilities