protobuf.js compiles protobuf definitions into JavaScript functions, and from version 8.2.0 up to and including 8.6.5 its Text Format extension parsed string‑keyed map entries using ordinary property assignment. If a map entry key is "__proto__", the assignment changes the prototype of the returned map object instead of creating a distinct map entry, resulting in prototype pollution.

The vulnerable component is the protobufjs library. Versions from 8.2.0 through 8.6.5 inclusive are affected; upgrading to 8.6.5 or a later release removes the flaw.

The CVSS score of 4.8 denotes low severity, and the EPSS score is under 1 %; the vulnerability is not catalogued in CISA KEV. Exploitation requires an attacker to supply crafted Text Format input containing a "__proto__" key that the application parses – this could occur locally or via an upstream data feed. With no known weaponised exploits and a modest CVSS, the overall risk is moderate; however, the potential for prototype pollution can undermine application security if untrusted data are parsed without validation.