protobufjs: Denial of Service via infinite loop in .proto option parsing

Description

protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.

This affects the reflection parsing path (parse, Root.load, Root.loadSync).

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.6.5

  >= 7.5.0, <= 7.6.4**

• Patched version(s): **8.6.6

  7.6.5**

References

• GHSA-j3f2-48v5-ccww
• CVE-2026-59877
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
• protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - CVE-2026-45740
• Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
• protobuf.js: Process-wide denial of service through unsafe option paths - CVE-2026-44290

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs