CVE-2023-36665 is a critical-severity (CVSS 9.8) CWE-1321 vulnerability in protobufjs. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for protobufjs — see the affected versions and patch details below.
protobufjs Prototype Pollution vulnerability
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-36665.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
protobufjsnpmDescription
protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about Object.constructor.prototype.<new-property> = ...; whereas CVE-2022-25878 was about Object.__proto__.<new-property> = ...; instead.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | protobufjs | ≥ 7.0.0&&< 7.2.5 | 7.2.5npm install protobufjs@7.2.5 |
| 📦npm | protobufjs | ≥ 6.10.0&&< 6.11.4 | 6.11.4npm install protobufjs@6.11.4 |
Affected Products
protobufjsprotobufjs_projectResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for protobufjs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update protobufjs to 7.2.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-36665 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2023-36665 in your dependencies?
Find it across npm, including transitive dependencies.