Every CVE Search/ Get API key

CVE-2026-45740

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

5.3 MediumFix available

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.26%Up 0.2 points since May 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

Record
CVE-2026-45740
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-02
EUVDEUVD-2026-30039 5.3

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

Record
EUVD-2026-30039
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-jggg-4jg4-v7c6 5.3

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Summary

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

Impact

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

Preconditions

  • The application must load JSON descriptor data influenced by an attacker.
  • The crafted descriptor must contain deeply nested nested namespace objects.
  • The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

Record
GHSA-jggg-4jg4-v7c6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-02
NVD 5.3

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

Record
CVE-2026-45740
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSV 5.3

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

Record
CVE-2026-45740
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-02
OSVGHSA-jggg-4jg4-v7c6 5.3

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Summary

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

Impact

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

Preconditions

  • The application must load JSON descriptor data influenced by an attacker.
  • The crafted descriptor must contain deeply nested nested namespace objects.
  • The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

Record
GHSA-jggg-4jg4-v7c6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-02
Show 15 moreShow less
OSVRHSA-2026:57590 8.6

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Record
RHSA-2026:57590
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-45740 5.3

CVE-2026-45740 in protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-45740
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1779670111 No score

TuxCare security update for protobufjs (3 CVEs)

TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 6.11.6-tuxcare.3.

Record
CLSA-2026-1779670111
Updated
2026-11-02
OSVCLSA-2026-1784164061 No score

TuxCare security update for protobufjs (4 CVEs)

TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.

Record
CLSA-2026-1784164061
Updated
2026-11-02
OSVCLSA-2026-1784769544 No score

TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.

Record
CLSA-2026-1784769544
Updated
2026-11-02
OSVCLSA-2026-1785380788 No score

TuxCare security update for protobufjs (3 CVEs)

TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 1.5.1-tuxcare.1.

Record
CLSA-2026-1785380788
Updated
2026-11-02
OSVCLSA-2026-1785380800 No score

TuxCare security update for protobufjs (4 CVEs)

TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 0.12.13-tuxcare.1.

Record
CLSA-2026-1785380800
Updated
2026-11-02
OSVCLSA-2026-1785468075 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.

Record
CLSA-2026-1785468075
Updated
2026-11-02
OSVCLSA-2026-1785468077 No score

TuxCare security update for protobufjs (7 CVEs)

TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.

Record
CLSA-2026-1785468077
Updated
2026-11-02
OSVCLSA-2026-1790770894 No score

TuxCare security update for protobufjs (4 CVEs)

TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.11.3-tuxcare.1.

Record
CLSA-2026-1790770894
Updated
2026-11-02
OSVCLSA-2026-1791218903 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.

Record
CLSA-2026-1791218903
Updated
2026-11-02
OSVCLSA-2026-1791293603 No score

TuxCare security update for protobufjs (12 CVEs)

TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.

Record
CLSA-2026-1791293603
Updated
2026-11-02
OSVCLSA-2026-1791362263 No score

TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.

Record
CLSA-2026-1791362263
Updated
2026-11-02
OSVCLSA-2026-1792490720 No score

TuxCare security update for protobufjs (12 CVEs)

TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.

Record
CLSA-2026-1792490720
Updated
2026-11-02
OSVCLSA-2026-1792755967 No score

TuxCare security update for protobufjs (7 CVEs)

TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 7.5.4-tuxcare.3.

Record
CLSA-2026-1792755967
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
protobufjs
npm
 through 7.5.7
7.5.8
protobufjs
npm
 8.0.0 up to 8.2.0
8.2.0
protobufjs
TuxCare:npm
From an advisory covering 3 CVEs
 6.11.6-tuxcare.0 up to 6.11.6-tuxcare.3, plus listed versions
6.11.66.11.6-tuxcare.16.11.6-tuxcare.2
6.11.6-tuxcare.3
protobufjs
TuxCare:npm
From an advisory covering 4 CVEs
 6.10.2-tuxcare.0 up to 6.10.2-tuxcare.1, plus listed versions
6.10.2
6.10.2-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 8 CVEs
 2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions
2.2.1
2.2.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 3 CVEs
 1.5.1-tuxcare.0 up to 1.5.1-tuxcare.1, plus listed versions
1.5.1
1.5.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 4 CVEs
 0.12.13-tuxcare.0 up to 0.12.13-tuxcare.1, plus listed versions
0.12.13
0.12.13-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 6.8.8-tuxcare.0 up to 6.8.8-tuxcare.1, plus listed versions
6.8.8
6.8.8-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.0-tuxcare.0 up to 5.0.0-tuxcare.2, plus listed versions
5.0.05.0.0-tuxcare.1
5.0.0-tuxcare.2
protobufjs
TuxCare:npm
From an advisory covering 4 CVEs
 6.11.3-tuxcare.0 up to 6.11.3-tuxcare.1, plus listed versions
6.11.3
6.11.3-tuxcare.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 7.4.0-tuxcare.0 up to 7.4.0-tuxcare.1, plus listed versions
7.4.0
7.4.0-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 12 CVEs
 8.0.0-tuxcare.0 up to 8.0.0-tuxcare.1, plus listed versions
8.0.0
8.0.0-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 11 CVEs
 8.0.1-tuxcare.0 up to 8.0.1-tuxcare.1, plus listed versions
8.0.1
8.0.1-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 12 CVEs
 3.8.2-tuxcare.0 up to 3.8.2-tuxcare.1, plus listed versions
3.8.2
3.8.2-tuxcare.1
protobufjs
TuxCare:npm
From an advisory covering 7 CVEs
 7.5.4-tuxcare.0 up to 7.5.4-tuxcare.3, plus listed versions
7.5.47.5.4-tuxcare.17.5.4-tuxcare.2
7.5.4-tuxcare.3
protobufjs
npm
 before 7.5.8
7.5.8
rh-podman-desktop
Red Hat:enterprise_linux:10.2
From an advisory covering 24 CVEs
 before 0:1.1.2-1.el10_2
0:1.1.2-1.el10_2
protobufjs
Root:npm
 before 7.5.6-aikido.2
7.5.6-aikido.27.5.5-aikido.37.5.4-aikido.47.5.7-aikido.28.0.1-aikido.48.0.3-aikido.26.11.4-aikido.26.11.6-aikido.27.5.5-aikido.47.5.4-aikido.58.0.1-aikido.58.0.1-aikido.68.0.3-aikido.37.5.4-aikido.67.4.0-aikido.66.11.4-aikido.36.11.6-aikido.36.11.6-aikido.47.5.7-aikido.37.5.6-aikido.36.11.4-aikido.48.0.3-aikido.46.11.6-aikido.57.5.5-aikido.58.0.1-aikido.77.5.4-aikido.77.4.0-aikido.77.5.5-aikido.68.0.3-aikido.57.5.6-aikido.47.5.7-aikido.48.0.1-aikido.87.5.4-aikido.86.11.4-aikido.57.5.7-aikido.57.5.6-aikido.57.5.5-aikido.78.0.3-aikido.68.0.1-aikido.96.11.6-aikido.67.5.5-aikido.88.2.0-aikido.18.2.0-aikido.28.2.0-aikido.3
@rootio/protobufjs
Root:npm
 before 7.5.4-root.io.3
7.5.4-root.io.37.5.5-root.io.27.5.7-root.io.18.0.1-root.io.38.0.3-root.io.16.11.4-root.io.17.5.6-root.io.16.11.6-root.io.17.5.6-root.io.27.5.5-root.io.37.5.4-root.io.47.5.7-root.io.28.0.1-root.io.48.0.3-root.io.26.11.4-root.io.26.11.6-root.io.27.5.5-root.io.47.5.4-root.io.58.0.1-root.io.58.0.1-root.io.68.0.3-root.io.37.5.4-root.io.67.4.0-root.io.66.11.4-root.io.36.11.6-root.io.36.11.6-root.io.47.5.7-root.io.37.5.6-root.io.36.11.4-root.io.48.0.3-root.io.46.11.6-root.io.57.5.5-root.io.58.0.1-root.io.77.5.4-root.io.77.4.0-root.io.77.5.5-root.io.68.0.3-root.io.57.5.6-root.io.47.5.7-root.io.48.0.1-root.io.87.5.4-root.io.86.11.4-root.io.57.5.7-root.io.57.5.6-root.io.57.5.5-root.io.78.0.3-root.io.68.0.1-root.io.96.11.6-root.io.67.5.5-root.io.88.2.0-root.io.18.2.0-root.io.28.2.0-root.io.3

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45740 is a medium vulnerability (CVSS 5.3) in Protobufjs Project Protobufjs, published May 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in protobufjs 7.5.8.

References

Show 166 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open