This vulnerability occurs when protobufjs compiles protobuf definitions into JavaScript functions. Prior to version 7.5.6 and 8.0.2, option paths could traverse inherited properties, allowing crafted schemas or JSON descriptors to write to global JavaScript constructor properties. Writing to those properties corrupts process‑wide built‑in functionality and results in a denial of service. The weakness is categorized as CWE‑1321, which addresses insecure use of global objects.

Affected vendors and products include protobufjs's protobuf.js library. The vulnerability exists in all releases prior to 7.5.6 and 8.0.2. Users employing older versions of this library are at risk.

The CVSS score is 7.5, indicating high severity. EPSS score is unavailable, so probability of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV. Attackers with access to supply a malicious protobuf definition to an application that uses protobufjs can trigger the denial of service by altering global constructors. Exploitation requires the ability to load or compile a protobuf schema, which may be possible via network or local file, depending on application context.