Description
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | protobufjs node module | Versions up to and including 6.8.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | protobufjs | >= 6.0.0, < 6.8.6 | 6.8.6 | GHSA-762f-c2wg-m8c8 |
| npm | protobufjs | < 5.0.3 | 5.0.3 | GHSA-762f-c2wg-m8c8 |