Is CVE-2026-48712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48712 being exploited in the wild.

How severe is CVE-2026-48712?

High severity, with a CVSS score of 7.5, published 22 June 2026.

Which products and versions are affected?

protobufjs (npm) SEMVER:introduced=0,fixed=7.6.1.

Is there a fix for CVE-2026-48712?

Yes. protobufjs (npm): upgrade to 7.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48712 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48712?

Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48712: protobufjs uncontrolled recursion in JSON conversion

CVE-2026-48712 · Severity: high · CVSS 7.5 · Published 2026-06-22

A vulnerability in the protobufjs library, which is used to handle data serialization in JavaScript applications, can allow an attacker to crash a service. By sending a specially crafted data payload with deeply nested structures, an attacker can trigger a stack overflow during the data conversion process. This results in a denial-of-service (DoS) condition, potentially taking down web servers or applications that process untrusted user input.

Technologies: protobufjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-48712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48712 being exploited in the wild.
How severe is CVE-2026-48712?: High severity, with a CVSS score of 7.5, published 22 June 2026.
Which products and versions are affected?: protobufjs (npm) SEMVER:introduced=0,fixed=7.6.1.
Is there a fix for CVE-2026-48712?: Yes. protobufjs (npm): upgrade to 7.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48712 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48712?: Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

protobufjs (npm): upgrade to 7.6.1 or later
```
npm install protobufjs@7.6.1
```

Technical details

The vulnerability is classified as uncontrolled recursion (CWE-674) within the protobufjs library's message conversion logic. Specifically, the `toObject()` conversion and the custom `google.protobuf.Any` JSON conversion path fail to enforce a recursion depth limit. An attacker can exploit this by providing a malicious protobuf binary payload containing deeply nested `Any` values. When the application attempts to convert this decoded message into a JSON string or a plain object (e.g., via `toJSON()` or `Type.toObject(message, { json: true })`), the engine's call stack is exhausted, causing the process to crash. This issue is resolved in versions 7.6.1 and 8.4.1.

Affected products

protobufjs protobuf.js < 7.6.1, >= 8.0.0 < 8.4.1

Identifiers

CVE-2026-48712
GHSA-wcpc-wj8m-hjx6

Timeline

2026-06-09: advisory: GitHub Security Advisory published
2026-06-22: disclosed: CVE published to NVD

References

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.