npm / protobufjs
protobufjs
What changed in protobufjs 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
16 security1 new APIs and options5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initprotobufjs 822 changes
Security 16
Overflowing length prefixes are now rejected.
Parsing for ProtoJSON and Text Format has been hardened.
protobufjs: Denial of Service via infinite loop in .proto option parsing
protobufjs: Text Format string map parsing can mutate returned map object prototype
protobufjs : Schema-derived names can shadow runtime-significant properties
protobufjs: Memory amplification from preserved unknown fields in binary decode
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
protobuf.js: Code generation gadget after prototype pollution
protobuf.js: Code injection through bytes field defaults in generated toObject code
protobuf.js: Denial of service from crafted field names in generated code
protobuf.js: Denial of service through unbounded protobuf recursion
protobuf.js: Process-wide denial of service through unsafe option paths
protobuf.js: Prototype injection in generated message constructors
protobufjs has overlong UTF-8 decoding
Arbitrary code execution in protobufjs
New APIs and options 1
Edition 2026 is now supported.
Fixes and other changes 5
Parsing now supports character, octal, and hex string escapes.
Custom enum JSON names are now supported.
Recursion in Any.fromObject is limited.
Decoding now respects declared lengths.
Symbol visibility is preserved.