Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59877protobufjs: Denial of Service via infinite loop in .proto option parsing

Medium 5.3

In plain English

A medium-severity infinite loop in protobuf.js from protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 69.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmprotobufjs7.6.5GHSA-j3f2-48v5-ccww
npmprotobufjs8.6.6GHSA-j3f2-48v5-ccww

Affected products (as reported)

VendorProductVersions
protobufjs protobuf.js >= 7.5.0, < 7.6.5>= 8.0.0, < 8.6.6

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References