Information Exposure in Protobuf.js by Protobuf.js

CVE-2026-59877

What is CVE-2026-59877?

The vulnerability in Protobuf.js arises from its flawed parsing logic for option names in protocol buffer definitions. Prior to the patches in versions 7.6.5 and 8.6.6, the library improperly handled end-of-input conditions while parsing, which could result in an infinite loop if a specially crafted .proto schema is employed. This could lead to prolonged denial of service situations, making it imperative for users to upgrade to the patched versions to mitigate potential exploitation risks.

References