CVE-2026-59876

mediumCVSS 4.8covered by 1 sourcefirst seen 2026-07-08

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

⚡ Watch CVE-2026-59876

Get an email if CVE-2026-59876 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-59876: protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.…nvd · 2026-07-08

External references

NVD record for CVE-2026-59876

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59876 status](https://www.csirts.com/badge/CVE-2026-59876)](https://www.csirts.com/cve/CVE-2026-59876)