CVE catalog
CVE-2026-59877
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without c
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.36% · Oct 25, 2026
A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive. protobufjs: protobufjs: Denial of Service via crafted .proto schema The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | protobufjs | Not reported | 7.6.5 | fixed |
| Cpe | protobufjs | Not reported | 8.6.6 | fixed |
| Npm | protobufjs | Not reported | 8.6.6 | fixed |
| Npm | protobufjs | Not reported | 8.6.6 | fixed |
| Npm | protobufjs | Not reported | 7.6.5 | fixed |
| Npm | protobufjs | Not reported | 8.6.6 | fixed |
| Cpe | protobufjs | Not reported | 8.6.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | protobufjs | cpe | Not reported | 7.6.5 | Not reported | Not reported | Not reported |
| Cpe | protobufjs | cpe | Not reported | 8.6.6 | Not reported | Not reported | Not reported |
| Npm | protobufjs | npm | Not reported | 8.6.6 | Not reported | GHSA-J3F2-48V5-CCWW | Not reported |
| Npm | protobufjs | npm | Not reported | 8.6.6 | Not reported | Not reported | Not reported |
| Npm | protobufjs | npm | Not reported | 7.6.5 | Not reported | Not reported | Not reported |
| Npm | protobufjs | npm | Not reported | 8.6.6 | Not reported | Not reported | Not reported |
| Cpe | protobufjs | cpe | Not reported | 8.6.6 | Not reported | NVD-CVE-2026-59877 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217]
- [https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f]
- [https://github.com/protobufjs/protobuf.js/pull/2352]
- [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5]
- [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6]
- [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-59877]
- [https://osv.dev/vulnerability/GHSA-j3f2-48v5-ccww]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59877.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2618.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]