Is NodeJS Buildpack using protobuf dependency?

Products

• VMware Tanzu Platform Core

Issue/Introduction

Our applications that are using NodeJS were scanned and found Proto6 vulnerabilities in protobuf.js – Risk of RCE and DoS in Node.js services, which include the following CVEs:

CVE-2026-44289 (CVSS score: 7.5): DoS through unbounded protobuf recursion 
CVE-2026-44290 (CVSS score: 7.5): Process-wide DoS when loading schemas with unsafe option paths 
CVE-2026-44291 (CVSS score: 8.1): Code generation gadget after prototype pollution 
CVE-2026-44292 (CVSS score: 5.3): Prototype injection in generated message constructors 
CVE-2026-44294 (CVSS score: 5.3): DoS from crafted field names in generated code

Does NodeJS uses protobuf.js as its dependency?

Environment

NodeJS Buildpack v1.12 and lower

Resolution

NodeJS Buildpack is not using protobuf as dependency and it is not affected by the Proto6 vulnerabilities.

The scanned is likely reporting this from your application dependencies. If protobuf.js is brought in as a dependency of your application (via npm or yarn), please update your application's package.json or package-lock.json to require version 7.5.6 / 8.0.2 or higher, then restage your application.

 

Additional Information

Useful article can be found here.