Skip to main content

Protobufjs EUVDEUVD-2026-42310

| CVE-2026-59877 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-08 GitHub_M GHSA-j3f2-48v5-ccww
Denial Of Service Protobuf Js Protobufjs
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 10, 2026

Denial-of-service via infinite loop in protobuf.js (the pure-JavaScript Protocol Buffers implementation for Node.js/browsers) affects versions 8.0.0 through <8.6.6 and 7.5.0 through <7.6.5. When the parser reads an option declaration in a .proto schema it advances through tokens looking for '=' without checking for end-of-input, so a truncated schema (e.g. 'option foo') hangs parse(), Root.load, or Root.loadSync forever, pinning a CPU core and stalling the event loop. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is low (0.33%, 25th percentile), matching the SSVC rating of exploitation 'none' but automatable.

Earlier versions of this analysis (2)
v2 Jul 10, 2026 - 19:14 cvss changed CVSS 7.5

Denial of service in protobuf.js (protobufjs) before 7.6.5 and 8.6.6 lets an attacker who can supply a crafted .proto schema hang the Node.js process indefinitely. The option-name parser advances through tokens looking for an '=' without checking for end-of-input, so an option declaration that terminates prematurely drives parse(), Root.load(), and Root.loadSync() into an infinite loop. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the vendor fix commit ships a minimal one-line reproducer test; EPSS is low at 0.33% (25th percentile).

v1 Jul 08, 2026 - 16:47 CVSS 5.3

Infinite loop denial of service in protobuf.js allows unauthenticated remote attackers to permanently stall any application that parses attacker-supplied .proto schemas. The option-name parser advances through tokens seeking an '=' delimiter without checking for end-of-input, so a crafted truncated schema freezes the calling thread indefinitely when passed to 'parse', 'Root.load', or 'Root.loadSync'. Versions prior to 7.6.5 (v7 branch) and 8.6.6 (v8 branch) are affected; no public exploit has been identified at time of analysis, though the attack is trivially reproducible from the description alone.

Affected VersionsENISA

protobuf.js 8.0.0, < 8.6.6
protobuf.js 7.5.0, < 7.6.5

Affected Packages

npm protobufjs fix: 7.6.5, 8.6.6
euvd protobuf_js_7_5_0 fix: 7.6.5
euvd protobuf_js_8_0_0 fix: 8.6.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Protobufjs gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Trivial, automatable trigger (AC:L) once untrusted schema reaches the parser with no auth or interaction (PR:N/UI:N); availability-only infinite-loop DoS gives A:H, C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 10, 2026 - 19:14 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 10, 2026 - 19:14 vuln.today
v2 - CVSS changed
Severity Changed
Jul 10, 2026 - 19:07 NVD
MEDIUM HIGH
CVSS changed
Jul 10, 2026 - 19:07 NVD
5.3 (MEDIUM) 7.5 (HIGH)
Patch available
Jul 08, 2026 - 17:01 EUVD

DescriptionNVD

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 107 npm packages depend on protobufjs (24 direct, 83 indirect)

Ecosystem-wide dependent count for version 7.5.0.

Executive ViewAI

Why It Matters

protobuf.js versions 8.0.0 through 8.6.5 and 7.5.0 through 7.6.4 contain a denial-of-service vulnerability that completely stalls Node.js and browser applications when parsing malformed Protocol Buffer schema files. A truncated schema causes the parser's event loop to hang indefinitely, consuming a full CPU core and rendering the application unresponsive. Any organization operating Node.js or browser-based services that process untrusted .proto schemas-including API backends, build pipelines, or development tools-faces risk of complete service unavailability.

Recommended Action

Within 24 hours: Audit all Node.js and browser applications to identify those using protobuf.js and document current versions. Within 7 days: Apply patches to all affected instances (8.x branch to 8.6.6 or later; 7.x branch to 7.6.5 or later) and validate in staging. Within 30 days: Confirm patch deployment across production and all non-production environments; implement schema validation to reject malformed input before parser invocation.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 75% exploitable
Threat Intel
1
1 sources
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Protobufjs

View all
CVE-2023-36665 CRITICAL POC
9.8 Jul 05

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than
CVE-2026-41242 CRITICAL POC
9.4 Apr 18

Code injection vulnerability in protobufjs (JavaScript protobuf library) allows authenticated attackers to execute arbit
CVE-2022-25878 HIGH POC
7.5 May 27

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify pro
CVE-2018-3738 MEDIUM POC
5.5 Jun 07

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Rated medium severity (CVSS 5.5), this vuln
CVE-2026-45740 MEDIUM POC
5.3 May 13

Uncontrolled recursion in protobufjs versions prior to 7.5.8 and 8.2.0 allows remote attackers to exhaust the JavaScript
CVE-2026-59876 MEDIUM
4.8 Jul 08

Prototype pollution in protobuf.js versions 8.2.0 through 8.6.4 allows network-reachable attackers to corrupt JavaScript

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2023-34966 HIGH
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59877 ADVISORY https://vuldb.com/vuln/376934 REF https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217 REF https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f REF https://github.com/protobufjs/protobuf.js/pull/2352 REF https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5 REF https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6 REF https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy