CVE catalog
CVE-2026-48712
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.46% · Oct 25, 2026
A flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS). protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | protobufjs | Not reported | 7.6.1 | fixed |
| Cpe | protobufjs | Not reported | 8.4.1 | fixed |
| Cpe | protobufjs | Not reported | 8.4.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | protobufjs | cpe | Not reported | 7.6.1 | Not reported | Not reported | Not reported |
| Cpe | protobufjs | cpe | Not reported | 8.4.1 | Not reported | Not reported | Not reported |
| Cpe | protobufjs | cpe | Not reported | 8.4.1 | Not reported | NVD-CVE-2026-48712 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-48712]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]