# What changed in protobufjs

> 22 changes in protobufjs 8 from its official release notes, upgrade guides and advisories: 16 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/protobufjs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## protobufjs 8

### Security

- Overflowing length prefixes are now rejected. (8.8.1) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.1)
- Parsing for ProtoJSON and Text Format has been hardened. (8.8.0) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.0)
- protobufjs: Denial of Service via infinite loop in .proto option parsing (7.6.5, 8.6.6) — [security advisory](https://github.com/advisories/GHSA-J3F2-48V5-CCWW)
- protobufjs: Text Format string map parsing can mutate returned map object prototype (8.6.5) — [security advisory](https://github.com/advisories/GHSA-JFJ6-75FJ-8934)
- protobufjs : Schema-derived names can shadow runtime-significant properties (7.6.3, 8.6.0) — [security advisory](https://github.com/advisories/GHSA-F38Q-MGVJ-VPH7)
- protobufjs: Memory amplification from preserved unknown fields in binary decode (8.5.0) — [security advisory](https://github.com/advisories/GHSA-94RC-8X27-4472)
- protobufjs: Denial of service through unbounded Any expansion during JSON conversion (7.6.1, 8.4.1) — [security advisory](https://github.com/advisories/GHSA-WCPC-WJ8M-HJX6)
- protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion (7.5.8, 8.2.0) — [security advisory](https://github.com/advisories/GHSA-JGGG-4JG4-V7C6)
- protobuf.js: Code generation gadget after prototype pollution (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-75PX-5XX7-5XC7)
- protobuf.js: Code injection through bytes field defaults in generated toObject code (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-66FF-XGX4-VCHM)
- protobuf.js: Denial of service from crafted field names in generated code (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-2PR8-PHX7-X9H3)
- protobuf.js: Denial of service through unbounded protobuf recursion (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-685M-2W69-288Q)
- protobuf.js: Process-wide denial of service through unsafe option paths (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-JVWF-75H9-CWGG)
- protobuf.js: Prototype injection in generated message constructors (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-FX83-V9X8-X52W)
- protobufjs has overlong UTF-8 decoding (7.5.6, 8.0.2) — [security advisory](https://github.com/advisories/GHSA-Q6X5-8V7M-XCRF)
- Arbitrary code execution in protobufjs (7.5.5, 8.0.1) — [security advisory](https://github.com/advisories/GHSA-XQ3M-2V4X-88GG)

### New APIs and options

- Edition 2026 is now supported. (8.8.0) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.0)

### Fixes and other changes

- Parsing now supports character, octal, and hex string escapes. (8.8.1) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.1)
- Custom enum JSON names are now supported. (8.8.1) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.1)
- Recursion in Any.fromObject is limited. (8.8.0) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.0)
- Decoding now respects declared lengths. (8.8.0) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.0)
- Symbol visibility is preserved. (8.8.0) — [release notes](https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.8.0)