# CVE-2018-3738: protobufjs regular expression denial of service

Source: https://junglewise.ai/threats/cve-2018-3738-protobufjs-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-3738 · Severity: low · CVSS 3.1 · Published 2018-10-09

protobufjs is a widely-used JavaScript library for parsing and serializing Protocol Buffer messages. Versions before 5.0.3 and 6.8.6 are vulnerable to a denial-of-service attack when processing specially crafted invalid .proto files. An attacker can craft a malicious .proto file that causes the parser's regular expression engine to hang or consume excessive CPU, disrupting applications that depend on this library.

Technologies: [protobufjs (npm)](https://junglewise.ai/threats/technologies/protobufjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-3738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3738 being exploited in the wild.

**How severe is CVE-2018-3738?** Low severity, with a CVSS score of 3.1, published 9 October 2018.

**Which products and versions are affected?** protobufjs (npm) SEMVER:introduced=6.0.0,fixed=6.8.6.

**Is there a fix for CVE-2018-3738?** Yes. protobufjs (npm): upgrade to 6.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-3738 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2018-3738?** Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- protobufjs (npm): upgrade to 6.8.6 or later

  ```sh
  npm install protobufjs@6.8.6
  ```


## Technical details

This vulnerability is a regular expression denial of service (ReDoS) in protobufjs's .proto file parser. The vulnerable code uses a regular expression in the parse module that exhibits catastrophic backtracking when processing crafted invalid input. The attack is triggered locally via a malicious .proto file (user interaction required—the file must be parsed). Successful exploitation causes CPU exhaustion and service disruption. Patches are available: update to version 5.0.3, 6.8.6, or later to remove the vulnerable regex pattern.

## Affected products

- protobufjs protobufjs before 5.0.3 and 6.0.0 before 6.8.6

## Identifiers

- CVE-2018-3738
- GHSA-762f-c2wg-m8c8

## Timeline

- 2018-06-07: disclosed
- 2018-10-09: advisory
- 2018-10-09: patched: versions 5.0.3 and 6.8.6 released

## References

- [https://hackerone.com/reports/319576](https://hackerone.com/reports/319576)

## Related threats

- [protobufjs prototype mutation in Text Format string map parsing](https://junglewise.ai/threats/cve-2026-59876-protobufjs-prototype-pollution-in-text-format-extension)
- [protobufjs infinite loop in .proto option parsing](https://junglewise.ai/threats/cve-2026-59877-protobufjs-infinite-loop-in-proto-option-parsing)
- [protobufjs memory amplification via unknown field preservation](https://junglewise.ai/threats/cve-2026-54270-protobufjs-memory-amplification-via-unknown-field-preservation)
- [protobufjs property shadowing and uncontrolled recursion](https://junglewise.ai/threats/cve-2026-54269-protobufjs-property-shadowing-and-uncontrolled-recursion)
- [protobufjs uncontrolled recursion in JSON conversion](https://junglewise.ai/threats/cve-2026-48712-protobufjs-uncontrolled-recursion-in-json-conversion)