Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

Researchers disclosed six vulnerabilities in protobuf.js (Proto6) that can cause RCE and DoS in Node.js applications. The report lists CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44294, and CVE-2026-44295, affected package versions, exploitation scenarios (including prototype pollution leading to code generation exploits), and available patches (protobufjs 7.5.6/8.0.2 and protobufjs-cli 1.2.1/2.0.2); it highlights potential wide impact on CI/CD, cloud SDKs, messaging frameworks, and AI/data ecosystems.