The vulnerability resides in the minimal UTF‑8 decoder bundled with protobuf.js. It accepts overlong byte sequences and maps them to their canonical Unicode characters instead of rejecting them. An attacker who can supply protobuf binary data can therefore cause bytes that lack certain ASCII characteristics to be decoded into strings containing those bytes, effectively bypassing application‑level checks that examine raw bytes prior to protobuf decoding.

This issue affects the open‑source JavaScript library protobuf.js. All releases before 7.5.6 and before 8.0.2 are impacted. Applications that rely on earlier versions and process untrusted protobuf messages are potentially vulnerable.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploitation yet. Exploitation requires an attacker able to supply crafted protobuf data to a vulnerable application. Such data could enable logical bypasses of validation but does not grant arbitrary code execution or direct system access. Nonetheless, the potential to bypass checks warrants timely remediation.