Currently in "sparkplug-payload" package there is - "protobufjs": "^6.11.3" That needs an upgrade to 7.2.5 at least to be resolved. Reference: CVE-2023-36665 Thanks!