Executive brief
A vulnerability in the protobufjs library, which is used to handle data serialization in JavaScript applications, can allow an attacker to crash a service. By sending a specially crafted data payload with deeply nested structures, an attacker can trigger a stack overflow during the data conversion process. This results in a denial-of-service (DoS) condition, potentially taking down web servers or applications that process untrusted user input.
Technical details
The vulnerability is classified as uncontrolled recursion (CWE-674) within the protobufjs library's message conversion logic. Specifically, the `toObject()` conversion and the custom `google.protobuf.Any` JSON conversion path fail to enforce a recursion depth limit. An attacker can exploit this by providing a malicious protobuf binary payload containing deeply nested `Any` values. When the application attempts to convert this decoded message into a JSON string or a plain object (e.g., via `toJSON()` or `Type.toObject(message, { json: true })`), the engine's call stack is exhausted, causing the process to crash. This issue is resolved in versions 7.6.1 and 8.4.1.
Affected products
- protobufjs protobuf.js < 7.6.1, >= 8.0.0 < 8.4.1
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD