protobufjs, a library that compiles protobuf definitions into JavaScript functions, improperly controls modification of object prototype attributes. Specifically, before versions 7.5.6 and 8.0.2, certain schema option paths could traverse inherited object properties during option application, enabling crafted inputs to write to global JavaScript constructor properties. This prototype pollution can corrupt process-wide built-in functionality. The vulnerability is identified as CWE-1321 and is fixed in protobufjs 7.5.6 and 8.0.2.

The vulnerability allows an attacker to modify prototype attributes of global JavaScript constructors, which can corrupt built-in functionality across the process. Although the CVSS score rates the impact as high due to potential availability impact (denial of service or process instability), there is no confidentiality or integrity impact reported. No known exploits have been observed in the wild.

Upgrade protobufjs to version 7.5.6 or later, or to version 8.0.2 or later. These versions contain fixes that prevent prototype pollution via crafted protobuf schemas or JSON descriptors. Patch status is confirmed by the vendor advisory indicating the issue is fixed in these versions.