Executive brief
A vulnerability in the protobufjs library, which is used to handle data serialization in JavaScript applications, can allow an attacker to crash a service. By providing a specially crafted data schema with conflicting names, an attacker can trigger errors or infinite loops that make the application unresponsive. This primarily impacts the availability of services that process untrusted data schemas.
Technical details
The vulnerability exists because protobufjs fails to properly sanitize or isolate schema-derived names that collide with internal runtime helper properties. Specifically, names such as 'hasOwnProperty', '$type', or service methods resulting in 'rpcCall' can shadow internal functions or metadata. When these names are encountered during decoding, verification, or RPC invocation, the library may attempt to execute or read schema-controlled data as if it were a trusted internal helper. This results in deterministic exceptions or uncontrolled recursion (CWE-674), leading to a denial of service. The issue is exploitable if an application loads untrusted schemas or JSON descriptors. Patches are available in versions 7.6.3 and 8.6.0.
Affected products
- protobufjs protobufjs < 7.6.3, >= 8.0.0, < 8.6.0
- protobufjs protobufjs-cli <= 1.3.2, >= 2.0.0, <= 2.5.0
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD