Proto6 flaws in protobuf.js enable RCE

Six vulnerabilities in protobuf.js allow remote code execution and DoS through malicious schemas, affecting Node.js apps, Google Cloud libraries, and CI/CD pipelines.

Cybersecurity researchers at Cyera have disclosed six vulnerabilities collectively dubbed Proto6 in protobuf.js, a widely-used JavaScript and TypeScript implementation of Google's Protocol Buffers serialization mechanism. The flaws affect Node.js applications using protobuf.js, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. The vulnerabilities stem from the library treating schemas and metadata as trusted by default, creating validation gaps that allow attackers to influence application behavior through malicious protobuf schemas, descriptors, or payloads.

The most critical flaw is CVE-2026-44291, which enables arbitrary JavaScript execution when attacker-controlled input reaches a prototype pollution gadget and protobuf.js later encodes or decodes a message in the same process. The library resolves type names through plain property lookups, allowing a polluted Object.prototype to inject attacker-controlled strings into generated encoder/decoder functions compiled via Function(). Other vulnerabilities enable DoS attacks through unbounded recursion, process-wide crashes from unsafe option paths, and code injection in static output generation. Attack scenarios include poisoning CI/CD workflows to leak build secrets and crashing WhatsApp bots built with Baileys through specially crafted messages.

Cyera warns that these conditions are increasingly common in data and AI ecosystems that routinely exchange schemas and configuration files across services and platforms. The vulnerabilities affect protobuf.js versions 7.5.5 and earlier, plus 8.0.0 through 8.0.1, as well as protobufjs-cli versions 1.2.0 and earlier, plus 2.0.0 through 2.0.1. Patches are available in protobuf.js 7.5.6 and 8.0.2, and protobufjs-cli 1.2.1 and 2.0.2. Organizations using the library in databases, vector stores, inference pipelines, orchestration systems, and cloud SDKs should prioritize updates to mitigate risks to enterprise and AI workloads.

title: Suspicious Child Process Spawned by Node.js Process
id: 2da4ff17-06fe-5248-910e-00ee18669d86
status: experimental
description: Detects command interpreters or scripting engines spawned as children
  of node.exe/node, which can indicate exploitation of a prototype-pollution RCE (e.g.
  Proto6/CVE-2026-44291) in a protobuf.js-based Node.js application leading to arbitrary
  code execution.
references:
- https://cyera.com
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \node.exe
  child_selection:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \wscript.exe
    - \cscript.exe
    - \curl.exe
    - \certutil.exe
  filter_devtools:
    CommandLine|contains:
    - 'npm '
    - 'npx '
    - node_modules\.bin
    - --version
  condition: selection and child_selection and not filter_devtools
fields:
- ParentImage
- Image
- CommandLine
- ParentCommandLine
falsepositives:
- Legitimate build/deploy scripts that invoke shells from a Node.js orchestrator (e.g.
  gulp, npm scripts)
- Developer tooling that launches editors or linters from a running Node.js process
level: medium
tags:
- attack.t1059.007
- attack.t1190
author: Vorant

title: Prototype Pollution Payload Pattern in HTTP Request Body
id: ab8f9128-9f12-5fbd-a335-08f9fc6b138d
status: experimental
description: Detects HTTP request payloads containing __proto__ or constructor.prototype
  key names, a hallmark of prototype-pollution attacks that can be leveraged against
  libraries such as protobuf.js (Proto6/CVE-2026-44291) to achieve remote code execution.
references:
- https://cyera.com
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains:
    - /decode
    - /encode
    - /schema
    - /protobuf
  payload_selection:
    request_body|contains:
    - __proto__
    - constructor.prototype
    - constructor%5B%22prototype%22%5D
  condition: selection and payload_selection
fields:
- c-uri
- request_body
- src_ip
- dst_ip
falsepositives:
- Security testing / bug bounty scanning of the same endpoints
- Legitimate JSON payloads that happen to include a field literally named __proto__
  for unrelated business logic
level: high
tags:
- attack.t1190
- attack.t1195.001
author: Vorant

title: Node.js Process Writing to CI-CD or Generated Code Files
id: c22d989b-3d37-5c2a-b9b4-6473fbe3edd5
status: experimental
description: Detects file writes by a node.exe/node process to CI/CD pipeline configuration
  files or generated JavaScript/TypeScript output, which may indicate poisoning of
  build artifacts or secrets via protobuf.js static code generation vulnerabilities
  (Proto6).
references:
- https://cyera.com
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \node.exe
  target_selection:
    TargetFilename|contains:
    - .github\workflows
    - .gitlab-ci
    - Jenkinsfile
    - .pb.js
    - .pb.d.ts
    - proto.js
  condition: selection and target_selection
fields:
- Image
- TargetFilename
- User
falsepositives:
- Normal build pipeline steps that regenerate protobuf bindings or update CI configuration
  as part of legitimate development
- Developer running protoc/pbjs code generation locally
level: medium
tags:
- attack.t1565.001
- attack.t1195.001
author: Vorant

Source reporting: https://thehackernews.com/2026/06/six-proto6-vulnerabilities-in.html