protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Description

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, < 8.2.0

  <= 7.5.7**

• Patched version(s): **8.2.0

  7.5.8**

References

• GHSA-jggg-4jg4-v7c6
• CVE-2026-45740
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs: Denial of service through unbounded Any expansion during JSON conversion - CVE-2026-48712
• protobufjs: Denial of Service via infinite loop in .proto option parsing - CVE-2026-59877
• Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
• ExifReader is vulnerable to denial of service via unbounded decompression of image metadata - CVE-2026-8814

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs