MEDIUM6.5

GHSA-j452-xhg8-qg39

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

Quick fix

GHSA-j452-xhg8-qg39 — protocol-buffers-schema: upgrade to the fixed version with the command below.

npm install protocol-buffers-schema@3.6.1

Details

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/protocol-buffers-schema

Introduced in: 0Fixed in: 3.6.1

Fixnpm install protocol-buffers-schema@3.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2026-5758[ADVISORY]
https://github.com/mafintosh/protocol-buffers-schema/pull/70[WEB]
https://github.com/mafintosh/protocol-buffers-schema[PACKAGE]
https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution[WEB]