CVE-2026-48712
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
- Record
CVE-2026-48712- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-38306
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
- Record
EUVD-2026-38306- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Summary
protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path.
A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON.
Impact
An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.
This affects applications that decode untrusted protobuf input containing google.protobuf.Any values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through JSON.stringify(message), Message#toJSON(), or Type.toObject(message, { json: true }).
Applications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.
Preconditions
- The application must decode protobuf binary data influenced by an attacker.
- The application schema must include
google.protobuf.Any, and the referencedtype_urlmust resolve to a message type in the loaded protobuf root. - The application must convert the decoded message to JSON or a plain object through an affected conversion path.
- The crafted input must contain deeply nested
Anyvalues that are expanded during conversion.
Workarounds
Avoid converting untrusted protobuf messages containing google.protobuf.Any values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested Any payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted Any values, or isolate message conversion in a process that can be safely restarted.
- Record
GHSA-wcpc-wj8m-hjx6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
- Record
CVE-2026-48712- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
- Record
CVE-2026-48712- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVGHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Summary
protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path.
A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON.
Impact
An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.
This affects applications that decode untrusted protobuf input containing google.protobuf.Any values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through JSON.stringify(message), Message#toJSON(), or Type.toObject(message, { json: true }).
Applications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.
Preconditions
- The application must decode protobuf binary data influenced by an attacker.
- The application schema must include
google.protobuf.Any, and the referencedtype_urlmust resolve to a message type in the loaded protobuf root. - The application must convert the decoded message to JSON or a plain object through an affected conversion path.
- The crafted input must contain deeply nested
Anyvalues that are expanded during conversion.
Workarounds
Avoid converting untrusted protobuf messages containing google.protobuf.Any values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested Any payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted Any values, or isolate message conversion in a process that can be safely restarted.
- Record
GHSA-wcpc-wj8m-hjx6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
Show 13 moreShow less
OSVCLSA-2026-1784164061 No score
TuxCare security update for protobufjs (4 CVEs)
TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.
- Record
CLSA-2026-1784164061- Updated
- 2026-11-02
OSVCLSA-2026-1784250508 No score
TuxCare security update for protobufjs (6 CVEs)
TuxCare rebuilt protobufjs to address 6 CVEs. Fixed in 6.11.6-tuxcare.4.
- Record
CLSA-2026-1784250508- Updated
- 2026-11-02
OSVCLSA-2026-1784769544 No score
TuxCare security update for protobufjs (8 CVEs)
TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.
- Record
CLSA-2026-1784769544- Updated
- 2026-11-02
OSVCLSA-2026-1785468075 No score
TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.
- Record
CLSA-2026-1785468075- Updated
- 2026-11-02
OSVCLSA-2026-1785468077 No score
TuxCare security update for protobufjs (7 CVEs)
TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.
- Record
CLSA-2026-1785468077- Updated
- 2026-11-02
OSVCLSA-2026-1790770894 No score
TuxCare security update for protobufjs (4 CVEs)
TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.11.3-tuxcare.1.
- Record
CLSA-2026-1790770894- Updated
- 2026-11-02
OSVCLSA-2026-1791218903 No score
TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.
- Record
CLSA-2026-1791218903- Updated
- 2026-11-02
OSVCLSA-2026-1791293603 No score
TuxCare security update for protobufjs (12 CVEs)
TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.
- Record
CLSA-2026-1791293603- Updated
- 2026-11-02
OSVCLSA-2026-1791362263 No score
TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.
- Record
CLSA-2026-1791362263- Updated
- 2026-11-02
OSVCLSA-2026-1792411164 No score
TuxCare security update for protobufjs (4 CVEs)
TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 7.5.4-tuxcare.1.
- Record
CLSA-2026-1792411164- Updated
- 2026-11-02
OSVCLSA-2026-1792490720 No score
TuxCare security update for protobufjs (12 CVEs)
TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.
- Record
CLSA-2026-1792490720- Updated
- 2026-11-02
OSVCLSA-2026-1793448517 No score
TuxCare security update for protobufjs (1 CVE)
TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 7.5.9-tuxcare.2.
- Record
CLSA-2026-1793448517- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-48712 No score
CVE-2026-48712 in protobufjs - Patched by Root
Root has patched CVE-2026-48712 in the protobufjs package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-48712- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
protobufjsnpm |
through 7.6.0 | 7.6.1 |
protobufjsnpm |
8.0.0 to 8.4.0 | 8.4.1 |
protobufjsTuxCare:npm From an advisory covering 4 CVEs |
6.10.2-tuxcare.0 up to 6.10.2-tuxcare.1, plus listed versions 6.10.2 |
6.10.2-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 6 CVEs |
6.11.6-tuxcare.0 up to 6.11.6-tuxcare.4, plus listed versions 6.11.66.11.6-tuxcare.16.11.6-tuxcare.26.11.6-tuxcare.3 |
6.11.6-tuxcare.4 |
protobufjsTuxCare:npm From an advisory covering 8 CVEs |
2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions 2.2.1 |
2.2.1-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 11 CVEs |
6.8.8-tuxcare.0 up to 6.8.8-tuxcare.1, plus listed versions 6.8.8 |
6.8.8-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 7 CVEs |
5.0.0-tuxcare.0 up to 5.0.0-tuxcare.2, plus listed versions 5.0.05.0.0-tuxcare.1 |
5.0.0-tuxcare.2 |
protobufjsTuxCare:npm From an advisory covering 4 CVEs |
6.11.3-tuxcare.0 up to 6.11.3-tuxcare.1, plus listed versions 6.11.3 |
6.11.3-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 11 CVEs |
7.4.0-tuxcare.0 up to 7.4.0-tuxcare.1, plus listed versions 7.4.0 |
7.4.0-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 12 CVEs |
8.0.0-tuxcare.0 up to 8.0.0-tuxcare.1, plus listed versions 8.0.0 |
8.0.0-tuxcare.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
protobufjsTuxCare:npm From an advisory covering 11 CVEs |
8.0.1-tuxcare.0 up to 8.0.1-tuxcare.1, plus listed versions 8.0.1 |
8.0.1-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 4 CVEs |
7.5.4-tuxcare.0 up to 7.5.4-tuxcare.1, plus listed versions 7.5.4 |
7.5.4-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 12 CVEs |
3.8.2-tuxcare.0 up to 3.8.2-tuxcare.1, plus listed versions 3.8.2 |
3.8.2-tuxcare.1 |
protobufjsTuxCare:npm |
7.5.9-tuxcare.0 up to 7.5.9-tuxcare.2, plus listed versions 7.5.97.5.9-tuxcare.1 |
7.5.9-tuxcare.2 |
protobufjsnpm |
before 7.6.1 | 7.6.1 |
protobufjsnpm |
8.0.0 up to 8.4.1 | 8.4.1 |
protobufjsRoot:npm |
before 6.11.2-aikido.1 | 6.11.2-aikido.17.5.4-aikido.67.4.0-aikido.57.4.0-aikido.67.5.7-aikido.37.5.8-aikido.17.5.6-aikido.36.11.4-aikido.48.2.0-aikido.18.0.3-aikido.46.11.6-aikido.57.5.5-aikido.58.0.1-aikido.78.3.0-aikido.17.5.4-aikido.77.4.0-aikido.77.5.5-aikido.68.0.3-aikido.57.5.6-aikido.47.5.8-aikido.28.3.0-aikido.27.5.7-aikido.48.0.1-aikido.88.2.0-aikido.27.5.4-aikido.86.11.4-aikido.57.5.7-aikido.58.2.0-aikido.37.5.6-aikido.57.5.5-aikido.77.5.8-aikido.38.3.0-aikido.38.0.3-aikido.68.0.1-aikido.96.11.6-aikido.67.5.5-aikido.87.5.3-aikido.17.6.0-aikido.17.2.0-aikido.37.3.2-aikido.2 |
@rootio/protobufjsRoot:npm |
before 6.11.2-root.io.1 | 6.11.2-root.io.17.5.4-root.io.67.4.0-root.io.57.4.0-root.io.67.5.7-root.io.37.5.8-root.io.17.5.6-root.io.36.11.4-root.io.48.2.0-root.io.18.0.3-root.io.46.11.6-root.io.57.5.5-root.io.58.0.1-root.io.78.3.0-root.io.17.5.4-root.io.77.4.0-root.io.77.5.5-root.io.68.0.3-root.io.57.5.6-root.io.47.5.8-root.io.28.3.0-root.io.27.5.7-root.io.48.0.1-root.io.88.2.0-root.io.27.5.4-root.io.86.11.4-root.io.57.5.7-root.io.58.2.0-root.io.37.5.6-root.io.57.5.5-root.io.77.5.8-root.io.38.3.0-root.io.38.0.3-root.io.68.0.1-root.io.96.11.6-root.io.67.5.5-root.io.87.5.3-root.io.17.6.0-root.io.17.2.0-root.io.37.3.2-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48712 is a high vulnerability (CVSS 7.5) in Protobufjs Project Protobufjs, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in protobufjs 7.6.1.