[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP-a-rfjYBAtjg8F4rDiCVLqmWOTypb8q4C653XTF8mQ":3},{"article":4,"iocs":50,"watch_terms":70,"solutions":71,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"593a58a7-a54e-4897-b388-16ef81955063","Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS","six-proto6-vulnerabilities-in-protobuf-js-expose-node-js-apps-to-rce-and-dos-85f025","Cybersecurity researchers have flagged half a dozen vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers (Protobuf), that, if successfully exploited, could result in remote code execution (RCE) and denial-of-service (DoS) attacks. \"In affected environments, a single malicious protobuf schema, descriptor, or crafted payload could be enough to trigger","Cybersecurity researchers have identified six vulnerabilities, collectively named Proto6, in the protobuf.js library, a JavaScript implementation of Protocol Buffers. These flaws, ranging in severity, can lead to remote code execution (RCE) and denial-of-service (DoS) attacks, particularly impacting Node.js applications, Google Cloud client libraries, and CI\u002FCD pipelines. The vulnerabilities stem from the library's default trust in schemas and metadata, potentially allowing attackers to poison CI\u002FCD workflows or crash services.","Six vulnerabilities in protobuf.js could lead to RCE and DoS in Node.js apps.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fsix-proto6-vulnerabilities-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiJXkAy-j0jwPWQiC9bJinbwINT6pxRmO7CJ_df4bkbAP3VD-xU8oblGB5ZBBR1oLMN0uqf_lBb5al4KSR82lU1kZsXu14TAMaXi6kIjcp5xxk5yLKnOCTloqgZd6w_PuzPxTxNROksgp9pld0D9HoxceBwprkC5cDXEvoSP64bzC_UZyZthInrECAReAeH\u002Fs1600\u002Fprotobuf.jpg","2026-06-10T05:08:35+00:00","2026-06-10T06:00:09.304727+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"protobuf.js","product",{"name":21,"type":22},"Protocol Buffers","technology",{"name":24,"type":19},"Google Cloud client libraries",{"name":26,"type":19},"Baileys",{"name":28,"type":29},"Google","vendor",{"name":31,"type":19},"Node.js","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[51,55,58,61,64,67],{"type":52,"value":53,"context":54},"cve","CVE-2026-44289","DoS through unbounded protobuf recursion",{"type":52,"value":56,"context":57},"CVE-2026-44290","Process-wide DoS when loading schemas with unsafe option paths",{"type":52,"value":59,"context":60},"CVE-2026-44291","Code generation gadget after prototype pollution",{"type":52,"value":62,"context":63},"CVE-2026-44292","Prototype injection in generated message constructors",{"type":52,"value":65,"context":66},"CVE-2026-44294","DoS from crafted field names in generated code",{"type":52,"value":68,"context":69},"CVE-2026-44295","Code injection in pbjs static output from crafted schema names",[28,18,24],{"controls":72,"vendors":151},[73,102,131],{"slug":74,"name":75,"problem":76,"products":77},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":103,"name":104,"problem":105,"products":106},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":132,"name":133,"problem":134,"products":135},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[136,144,145],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":146,"product_name":147,"url":149,"description":150},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":163},"proto6-vulnerabilities-expose-critical-supply-chain-security-gaps","Proto6 Vulnerabilities Expose Critical Supply Chain Security Gaps","Six vulnerabilities in the widely-used protobuf.js library demonstrate how third-party dependencies can introduce severe security risks including remote code execution and denial-of-service attacks. The flaws stem from the library's default trust in schemas and metadata, allowing attackers to potentially poison CI\u002FCD workflows or crash Node.js applications. This incident highlights the critical importance of supply chain security, as vulnerabilities in popular libraries can impact countless downstream applications and development pipelines. Organizations must treat third-party dependencies as potential attack vectors requiring continuous monitoring and rapid response capabilities.",[157,158,159,160,161,162],"CIS Control 2","CIS Control 7","NIST SP 800-161","NIST SP 800-53 SA-4","OWASP Top 10 A06","ISO 27001 A.15.1",{}]