Denial of Service Vulnerability in Protobuf.js by Protobuf Team

CVE-2026-48712

What is CVE-2026-48712?

Protobuf.js, a library for compiling protobuf definitions into JavaScript functions, had a vulnerability that allowed for potential denial of service through deep recursion. Specifically, prior to versions 7.6.1 and 8.4.1, the library could exhaust the JavaScript call stack when converting decoded messages to plain objects or JSON. This occurred particularly when dealing with crafted protobuf binary payloads, which contained deeply nested Any values. The issue has been resolved in the mentioned versions, enhancing the stability and security of the library.

References