Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-59877 EUVD-2026-42310GHSA-j3f2-48v5-ccww

protobufjs: Denial of Service via infinite loop in .proto option parsing

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by GitHub_M

Vendor: protobufjs Product: protobuf.js Package: jitsucom-jitsu-console Package: kubeflow-centraldashboard Package: protobufjs Package: pulumi-language-nodejs Package: vitess-24 Package: vitess-24-compat Ecosystem: npm Ecosystem: Wolfi

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Affected products

VendorProductAffectedFixed
protobufjs protobuf.js >= 7.5.0, < 7.6.5, >= 8.0.0, < 8.6.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 rh-podman-desktop 1.1.2-1.el10_2 RHSA-2026:57590

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jitsucom-jitsu-console 2.11.0-r30 —
Wolfi rolling kubeflow-centraldashboard 1.10.0-r25 —
Wolfi rolling pulumi-language-nodejs 3.253.0-r2 —
Wolfi rolling vitess-24 24.0.2-r6 —
Wolfi rolling vitess-24-compat 24.0.3-r7 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm protobufjs >= 7.5.0, < 7.6.5 7.6.5 GHSA-j3f2-48v5-ccww
npm protobufjs >= 8.0.0, < 8.6.6 8.6.6 GHSA-j3f2-48v5-ccww

Advisories 2

References