protobuf.js, a JavaScript library for compiling protobuf definitions, included a minimal UTF-8 decoder that improperly handled overlong UTF-8 byte sequences by decoding them to their canonical characters rather than rejecting or replacing them. This improper handling (CWE-176) could allow an attacker who controls protobuf binary input to bypass application-level byte inspections that occur before string decoding, potentially causing the application to accept strings containing characters that were not present in the raw byte stream. The issue affects protobuf.js versions before 7.5.6 and versions from 8.0.0 up to but not including 8.0.2. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts integrity but not confidentiality or availability. No known exploits are reported in the wild. The vulnerability is fixed in protobuf.js versions 7.5.6 and 8.0.2.

This vulnerability allows an attacker who can supply protobuf binary data to bypass application-level checks that inspect raw bytes before protobuf string decoding. This could lead to integrity issues where the application processes strings containing unexpected characters, potentially affecting application logic or security controls relying on raw byte inspection. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Upgrading protobuf.js to version 7.5.6 or later (for the 7.x series) or to version 8.0.2 or later (for the 8.x series) resolves this vulnerability. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is fixed in these versions. Users should update to these fixed versions to mitigate the risk. No additional mitigation steps are indicated.