EUVD-2026-30039
GHSA-jggg-4jg4-v7c6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1,329 npm packages depend on protobufjs (82 direct, 1,248 indirect)
Ecosystem-wide dependent count for version 8.0.0.
DescriptionGitHub Advisory
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.
AnalysisAI
Uncontrolled recursion in protobufjs versions prior to 7.5.8 and 8.2.0 allows remote attackers to exhaust the JavaScript call stack by providing crafted JSON descriptors with deeply nested namespace definitions to Root.fromJSON() or Namespace.addJSON(), causing a denial of service. The vulnerability requires only network access and no authentication, though exploitation depends on the application parsing untrusted protobuf JSON descriptors.
Technical ContextAI
protobufjs is a JavaScript implementation of Protocol Buffers that dynamically compiles protobuf message definitions from JSON descriptors into executable JavaScript functions. The vulnerability exists in the recursive descriptor expansion logic within Root.fromJSON() and Namespace.addJSON() methods, which traverse and process nested namespace structures without enforcing a recursion depth limit (CWE-674: Uncontrolled Recursion). When processing a maliciously crafted JSON descriptor containing exceptionally deep nesting of namespace definitions, the call stack grows until JavaScript's maximum call stack size is exceeded, triggering a stack overflow that terminates the affected process. This is a classic denial-of-service vector against recursive parsing logic.
RemediationAI
Upgrade protobufjs to version 7.5.8 or 8.2.0 or later. For npm-based projects, run 'npm update protobufjs' to fetch the patched version, or explicitly install 'npm install protobufjs@7.5.8' or 'npm install protobufjs@8.2.0' depending on the major version in use. The fix implements recursion depth limits in Root.fromJSON() and Namespace.addJSON(), preventing stack exhaustion from deeply nested descriptors. No workarounds are available for older versions; patching is the only remediation. If immediate upgrading is impossible, apply defense-in-depth measures including rate-limiting and request size limits on any endpoints that accept protobuf JSON descriptors, though these are not substitutes for patching. Verify patch application by checking package.json lock files and running 'npm list protobufjs' to confirm the installed version meets the minimum fixed versions. The GitHub Security Advisory (https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6) contains additional guidance.
More in Protobuf Js
View allCode injection vulnerability in protobufjs (JavaScript protobuf library) allows authenticated attackers to execute arbit
Denial-of-service via infinite loop in protobuf.js (the pure-JavaScript Protocol Buffers implementation for Node.js/brow
Prototype pollution in protobuf.js versions 8.2.0 through 8.6.4 allows network-reachable attackers to corrupt JavaScript
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today