CVE-2026-59877
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.36% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-835
- Affected
- protobufjs project/protobufjs
- Source
- security-advisories@github.com
References
- https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217Patch
- https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69fPatch
- https://github.com/protobufjs/protobuf.js/pull/2352Issue Tracking, Patch
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5Product, Release Notes
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6Product, Release Notes
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccwwMitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.