# CVE-2026-48712: protobufjs uncontrolled recursion in JSON conversion

Source: https://junglewise.ai/threats/cve-2026-48712-protobufjs-uncontrolled-recursion-in-json-conversion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-48712 · Severity: high · CVSS 7.5 · Published 2026-06-22

A vulnerability in the protobufjs library, which is used to handle data serialization in JavaScript applications, can allow an attacker to crash a service. By sending a specially crafted data payload with deeply nested structures, an attacker can trigger a stack overflow during the data conversion process. This results in a denial-of-service (DoS) condition, potentially taking down web servers or applications that process untrusted user input.

Technologies: [protobufjs (npm)](https://junglewise.ai/threats/technologies/protobufjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-48712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48712 being exploited in the wild.

**How severe is CVE-2026-48712?** High severity, with a CVSS score of 7.5, published 22 June 2026.

**Which products and versions are affected?** protobufjs (npm) SEMVER:introduced=0,fixed=7.6.1.

**Is there a fix for CVE-2026-48712?** Yes. protobufjs (npm): upgrade to 7.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48712 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48712?** Check whether you run protobufjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- protobufjs (npm): upgrade to 7.6.1 or later

  ```sh
  npm install protobufjs@7.6.1
  ```


## Technical details

The vulnerability is classified as uncontrolled recursion (CWE-674) within the protobufjs library's message conversion logic. Specifically, the `toObject()` conversion and the custom `google.protobuf.Any` JSON conversion path fail to enforce a recursion depth limit. An attacker can exploit this by providing a malicious protobuf binary payload containing deeply nested `Any` values. When the application attempts to convert this decoded message into a JSON string or a plain object (e.g., via `toJSON()` or `Type.toObject(message, { json: true })`), the engine's call stack is exhausted, causing the process to crash. This issue is resolved in versions 7.6.1 and 8.4.1.

## Affected products

- protobufjs protobuf.js < 7.6.1, >= 8.0.0 < 8.4.1

## Identifiers

- CVE-2026-48712
- GHSA-wcpc-wj8m-hjx6

## Timeline

- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD

## References

- [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6)

## Related threats

- [protobufjs prototype mutation in Text Format string map parsing](https://junglewise.ai/threats/cve-2026-59876-protobufjs-prototype-pollution-in-text-format-extension)
- [protobufjs infinite loop in .proto option parsing](https://junglewise.ai/threats/cve-2026-59877-protobufjs-infinite-loop-in-proto-option-parsing)
- [protobufjs memory amplification via unknown field preservation](https://junglewise.ai/threats/cve-2026-54270-protobufjs-memory-amplification-via-unknown-field-preservation)
- [protobufjs property shadowing and uncontrolled recursion](https://junglewise.ai/threats/cve-2026-54269-protobufjs-property-shadowing-and-uncontrolled-recursion)
- [protobufjs uncontrolled recursion in JSON descriptor expansion](https://junglewise.ai/threats/cve-2026-45740-protobufjs-uncontrolled-recursion-in-json-descriptor-expansion)