CVE-2026-59877: protobufjs: Denial of Service via infinite loop in .proto option parsing
protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.
This affects the reflection parsing path (parse, Root.load, Root.loadSync).
References
- github.com/advisories/GHSA-j3f2-48v5-ccww
- github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
- github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
- github.com/protobufjs/protobuf.js/pull/2352
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
- github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww
- nvd.nist.gov/vuln/detail/CVE-2026-59877
Code Behaviors & Features
Detect and mitigate CVE-2026-59877 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →