Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. protobufjs
  4. ›
  5. CVE-2026-59877

CVE-2026-59877: protobufjs: Denial of Service via infinite loop in .proto option parsing

July 20, 2026

protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.

This affects the reflection parsing path (parse, Root.load, Root.loadSync).

References

  • github.com/advisories/GHSA-j3f2-48v5-ccww
  • github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
  • github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
  • github.com/protobufjs/protobuf.js/pull/2352
  • github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
  • github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
  • github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww
  • nvd.nist.gov/vuln/detail/CVE-2026-59877

Code Behaviors & Features

Detect and mitigate CVE-2026-59877 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 7.5.0 before 7.6.5, all versions starting from 8.0.0 before 8.6.6

Fixed versions

  • 7.6.5
  • 8.6.6

Solution

Upgrade to versions 7.6.5, 8.6.6 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Source file

npm/protobufjs/CVE-2026-59877.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:19:26 +0000.