protobufjs CVE-2026-45740

The vulnerability can be exploited only when the application calls Root.fromJSON() or Namespace.addJSON() with a JSON descriptor sourced from an attacker-controlled or untrusted input stream. Applications that load only hardcoded or pre-validated protobuf descriptor files from trusted sources are not vulnerable. The descriptor parsing must be reachable from the network (either via HTTP/REST API, message queue, or other network service) for remote exploitation. Exploitation does not require authentication (PR:N in CVSS vector) and works against default configurations. However, if the application is configured to parse descriptors only from local, validated sources, or if descriptor parsing is internal to the application and not exposed to external input, the attack surface is eliminated. The key limiting factor is whether untrusted descriptor input reaches the vulnerable parsing functions.

The CVSS score of 5.3 (Medium) reflects a network-accessible denial-of-service vulnerability with low attack complexity and no authentication requirement, but limited scope and impact (availability only - no confidentiality or integrity breach). The EPSS score and active exploitation status are not provided in the data; however, KEV listing is not indicated, suggesting no confirmed active exploitation in the wild at time of analysis. The real-world risk depends critically on deployment context: applications that parse protobuf JSON descriptors from untrusted sources (e.g., user-supplied files, API inputs, or network streams) face direct exposure. Applications parsing only trusted, internal descriptor definitions face minimal risk. The attack complexity is low (AC:L) and requires no special privileges (PR:N), making this exploitable by any network participant if descriptor parsing is exposed. The impact is denial of service only - no data exfiltration or system compromise - which moderates urgency relative to code-execution vulnerabilities.

An attacker crafts a malicious protobuf JSON descriptor file containing a namespace structure nested to extreme depth (potentially thousands of levels). The attacker delivers this descriptor to an application that parses user-uploaded protobuf definitions or fetches them from an untrusted source. When Root.fromJSON() or Namespace.addJSON() processes this descriptor, recursive calls accumulate on the call stack without limit until JavaScript's maximum call stack depth is reached, causing the process to crash. This results in denial of service, rendering the application unavailable to legitimate users.