Description
protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.
This affects the reflection parsing path (parse, Root.load, Root.loadSync).
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, <= 8.6.5 >= 7.5.0, <= 7.6.4** Patched version(s): **8.6.6 7.6.5**
References
Could your website be exposed too?
SmartScanner can check your website for protobufjs: Denial of Service via infinite loop in .proto option parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
- protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - CVE-2026-45740
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
- protobuf.js: Process-wide denial of service through unsafe option paths - CVE-2026-44290
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026