Description
protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().
A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, < 8.2.0 <= 7.5.7** Patched version(s): **8.2.0 7.5.8**
References
Could your website be exposed too?
SmartScanner can check your website for protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- protobufjs: Denial of service through unbounded Any expansion during JSON conversion - CVE-2026-48712
- protobufjs: Denial of Service via infinite loop in .proto option parsing - CVE-2026-59877
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- ExifReader is vulnerable to denial of service via unbounded decompression of image metadata - CVE-2026-8814
You might also like:
See something that needs correcting? Let us knowUpdated May 19, 2026