Protobuf.js compiles protobuf definitions into JavaScript functions. In prior to version 7.5.6 and 8.0.2, the generated message constructors copied enumerable properties from a supplied properties object without filtering the __proto__ key. If an application creates a message from an attacker‑controlled plain object that contains an own enumerable __proto__ property, the prototype of that individual message instance can be altered. The weakness is categorized as CWE‑1321.

The vulnerability affects the protobuf.js library from the protobufjs vendor. All releases of protobuf.js earlier than 7.5.6 and 8.0.2 are susceptible.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation prevalence is unclear. The likely attack vector is an application that constructs protobuf messages from untrusted data, which could be driven by a malicious user or compromised third‑party input. An attacker would need to control the payload passed to the constructor; no additional network exposure or privileged state is required beyond what the application already accepts.