Skip to content
Log inStart free trial

GHSA-jggg-4jg4-v7c6 CVE-2026-45740

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

High npm
Severity
5.3 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.26%
Chance of exploitation in the next 30 days. Higher than 18.17% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-674 Uncontrolled Recursion
Fix
7.5.8
Upgrade protobufjs to this version or later

Description

Summary

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

Impact

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

Preconditions

  • The application must load JSON descriptor data influenced by an attacker.
  • The crafted descriptor must contain deeply nested nested namespace objects.
  • The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

Affected versions

npm

PackageVulnerableFixed in
protobufjs
< 7.5.8
7.5.8
protobufjs
>= 8.0.0, < 8.2.0
8.2.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

protobufjs npm → 7.5.8

npm
npm install protobufjs@7.5.8
yarn
yarn add protobufjs@7.5.8
pnpm
pnpm add protobufjs@7.5.8

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-674: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How to prevent it
  • Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
  • Implementation: Increase the stack size.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-j3f2-48v5-ccww
protobufjs: Denial of Service via infinite loop in .proto option parsing
High Also affects protobufjs
GHSA-jfj6-75fj-8934
protobufjs: Text Format string map parsing can mutate returned map object prototype
Medium Also affects protobufjs
GHSA-94rc-8x27-4472
protobufjs: Memory amplification from preserved unknown fields in binary decode
Medium Also affects protobufjs
GHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
High Also affects protobufjs
GHSA-f38q-mgvj-vph7
protobufjs : Schema-derived names can shadow runtime-significant properties
Medium Also affects protobufjs
GHSA-2pr8-phx7-x9h3
protobuf.js: Denial of service from crafted field names in generated code
Medium Also affects protobufjs
GHSA-66ff-xgx4-vchm
protobuf.js: Code injection through bytes field defaults in generated toObject code
High Also affects protobufjs
GHSA-fx83-v9x8-x52w
protobuf.js: Prototype injection in generated message constructors
Medium Also affects protobufjs
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor