Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

Security researchers have identified a set of critical vulnerabilities in protobuf.js, a widely used JavaScript and TypeScript implementation of Protocol Buffers, potentially exposing countless Node.js applications to severe security risks. The discovery raises significant concerns for organizations relying on this library, as successful exploitation could lead to remote code execution and denial-of-service attacks that might compromise entire systems.

The six vulnerabilities, collectively referred to as Proto6 flaws, were found within the protobuf.js library, which serves as a bridge for JavaScript applications to implement Protocol Buffers—Google's language-neutral data interchange format extensively used in microservices communications and API development. These security gaps exist in the library's handling of specially crafted protobuf schemas, descriptors, or malicious payloads that attackers could manipulate to trigger