Denial of Service Vulnerability in Protobuf.js JavaScript Library

CVE-2026-45740

What is CVE-2026-45740?

The Protobuf.js JavaScript library has a vulnerability that allows attackers to exploit deeply nested JSON descriptors, leading to a denial of service. Specifically, prior to versions 7.5.8 and 8.2.0, the library's methods—Root.fromJSON() and Namespace.addJSON()—lack depth limitations, which can result in an infinite recursion scenario during descriptor loading. This exhaustion of the JavaScript call stack can be triggered by a crafted JSON, effectively freezing or crashing the application. Users are strongly encouraged to upgrade to the fixed versions to mitigate this risk.

References