{"id":"CVE-2026-45740","aliases":["CLSA-2026-1779670111","CLSA-2026-1784164061","CLSA-2026-1784769544","CLSA-2026-1785380788","CLSA-2026-1785380800","CLSA-2026-1785468075","CLSA-2026-1785468077","CLSA-2026-1790770894","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1791362263","CLSA-2026-1792490720","CLSA-2026-1792755967","EUVD-2026-30039","GHSA-jggg-4jg4-v7c6","RHSA-2026:57590","ROOT-APP-NPM-CVE-2026-45740"],"status":"published","title":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00263,"percentile":0.18244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-05-13T14:46:02Z","modified":"2026-10-30T19:45:57Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["7.5.8","8.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["7.5.6-aikido.2","7.5.5-aikido.3","7.5.4-aikido.4","7.5.7-aikido.2","8.0.1-aikido.4","8.0.3-aikido.2","6.11.4-aikido.2","6.11.6-aikido.2","7.5.5-aikido.4","7.5.4-aikido.5","8.0.1-aikido.5","8.0.1-aikido.6","8.0.3-aikido.3","7.5.4-aikido.6","7.4.0-aikido.6","6.11.4-aikido.3","6.11.6-aikido.3","6.11.6-aikido.4","7.5.7-aikido.3","7.5.6-aikido.3","6.11.4-aikido.4","8.0.3-aikido.4","6.11.6-aikido.5","7.5.5-aikido.5","8.0.1-aikido.7","7.5.4-aikido.7","7.4.0-aikido.7","7.5.5-aikido.6","8.0.3-aikido.5","7.5.6-aikido.4","7.5.7-aikido.4","8.0.1-aikido.8","7.5.4-aikido.8","6.11.4-aikido.5","7.5.7-aikido.5","7.5.6-aikido.5","7.5.5-aikido.7","8.0.3-aikido.6","8.0.1-aikido.9","6.11.6-aikido.6","7.5.5-aikido.8","8.2.0-aikido.1","8.2.0-aikido.2","8.2.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["7.5.4-root.io.3","7.5.5-root.io.2","7.5.7-root.io.1","8.0.1-root.io.3","8.0.3-root.io.1","6.11.4-root.io.1","7.5.6-root.io.1","6.11.6-root.io.1","7.5.6-root.io.2","7.5.5-root.io.3","7.5.4-root.io.4","7.5.7-root.io.2","8.0.1-root.io.4","8.0.3-root.io.2","6.11.4-root.io.2","6.11.6-root.io.2","7.5.5-root.io.4","7.5.4-root.io.5","8.0.1-root.io.5","8.0.1-root.io.6","8.0.3-root.io.3","7.5.4-root.io.6","7.4.0-root.io.6","6.11.4-root.io.3","6.11.6-root.io.3","6.11.6-root.io.4","7.5.7-root.io.3","7.5.6-root.io.3","6.11.4-root.io.4","8.0.3-root.io.4","6.11.6-root.io.5","7.5.5-root.io.5","8.0.1-root.io.7","7.5.4-root.io.7","7.4.0-root.io.7","7.5.5-root.io.6","8.0.3-root.io.5","7.5.6-root.io.4","7.5.7-root.io.4","8.0.1-root.io.8","7.5.4-root.io.8","6.11.4-root.io.5","7.5.7-root.io.5","7.5.6-root.io.5","7.5.5-root.io.7","8.0.3-root.io.6","8.0.1-root.io.9","6.11.6-root.io.6","7.5.5-root.io.8","8.2.0-root.io.1","8.2.0-root.io.2","8.2.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.7"},{"fixed":"7.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.3"}]}],"versions":["6.11.6","6.11.6-tuxcare.1","6.11.6-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.2-tuxcare.0"},{"fixed":"6.10.2-tuxcare.1"}]}],"versions":["6.10.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.13-tuxcare.0"},{"fixed":"0.12.13-tuxcare.1"}]}],"versions":["0.12.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-tuxcare.0"},{"fixed":"5.0.0-tuxcare.2"}]}],"versions":["5.0.0","5.0.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.1"}]}],"versions":["6.11.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.1-tuxcare.0"},{"fixed":"8.0.1-tuxcare.1"}]}],"versions":["8.0.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.3"}]}],"versions":["7.5.4","7.5.4-tuxcare.1","7.5.4-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.2.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.6-aikido.2"},{"fixed":"7.5.5-aikido.3"},{"fixed":"7.5.4-aikido.4"},{"fixed":"7.5.7-aikido.2"},{"fixed":"8.0.1-aikido.4"},{"fixed":"8.0.3-aikido.2"},{"fixed":"6.11.4-aikido.2"},{"fixed":"6.11.6-aikido.2"},{"fixed":"7.5.5-aikido.4"},{"fixed":"7.5.4-aikido.5"},{"fixed":"8.0.1-aikido.5"},{"fixed":"8.0.1-aikido.6"},{"fixed":"8.0.3-aikido.3"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.6"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.6-aikido.3"},{"fixed":"6.11.6-aikido.4"},{"fixed":"7.5.7-aikido.3"},{"fixed":"7.5.6-aikido.3"},{"fixed":"6.11.4-aikido.4"},{"fixed":"8.0.3-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.3-aikido.5"},{"fixed":"7.5.6-aikido.4"},{"fixed":"7.5.7-aikido.4"},{"fixed":"8.0.1-aikido.8"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"7.5.7-aikido.5"},{"fixed":"7.5.6-aikido.5"},{"fixed":"7.5.5-aikido.7"},{"fixed":"8.0.3-aikido.6"},{"fixed":"8.0.1-aikido.9"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"},{"fixed":"8.2.0-aikido.1"},{"fixed":"8.2.0-aikido.2"},{"fixed":"8.2.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.4-root.io.3"},{"fixed":"7.5.5-root.io.2"},{"fixed":"7.5.7-root.io.1"},{"fixed":"8.0.1-root.io.3"},{"fixed":"8.0.3-root.io.1"},{"fixed":"6.11.4-root.io.1"},{"fixed":"7.5.6-root.io.1"},{"fixed":"6.11.6-root.io.1"},{"fixed":"7.5.6-root.io.2"},{"fixed":"7.5.5-root.io.3"},{"fixed":"7.5.4-root.io.4"},{"fixed":"7.5.7-root.io.2"},{"fixed":"8.0.1-root.io.4"},{"fixed":"8.0.3-root.io.2"},{"fixed":"6.11.4-root.io.2"},{"fixed":"6.11.6-root.io.2"},{"fixed":"7.5.5-root.io.4"},{"fixed":"7.5.4-root.io.5"},{"fixed":"8.0.1-root.io.5"},{"fixed":"8.0.1-root.io.6"},{"fixed":"8.0.3-root.io.3"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.6"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.6-root.io.3"},{"fixed":"6.11.6-root.io.4"},{"fixed":"7.5.7-root.io.3"},{"fixed":"7.5.6-root.io.3"},{"fixed":"6.11.4-root.io.4"},{"fixed":"8.0.3-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.3-root.io.5"},{"fixed":"7.5.6-root.io.4"},{"fixed":"7.5.7-root.io.4"},{"fixed":"8.0.1-root.io.8"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"7.5.7-root.io.5"},{"fixed":"7.5.6-root.io.5"},{"fixed":"7.5.5-root.io.7"},{"fixed":"8.0.3-root.io.6"},{"fixed":"8.0.1-root.io.9"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"},{"fixed":"8.2.0-root.io.1"},{"fixed":"8.2.0-root.io.2"},{"fixed":"8.2.0-root.io.3"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jggg-4jg4-v7c6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45740.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["article"]},{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-45740","title":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","status":"published","published":"2026-05-13T14:46:02.689Z","modified":"2026-05-13T18:20:12.394Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-30039","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","status":"published","published":"2026-05-13T14:46:02Z","modified":"2026-05-13T18:20:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:04:33.260537Z"}],"ghsa":[{"id":"GHSA-jggg-4jg4-v7c6","title":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while expanding nested JSON descriptors through `Root.fromJSON()` and `Namespace.addJSON()`.\n\nA crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.\n\n## Impact\n\nAn attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.\n\nThis affects applications that load JSON descriptors from untrusted sources with affected versions.\n\n## Preconditions\n\n- The application must load JSON descriptor data influenced by an attacker.\n- The crafted descriptor must contain deeply nested `nested` namespace objects.\n- The affected `Root.fromJSON()` / `Namespace.addJSON()` descriptor expansion path must process the crafted input.\n\n## Workarounds\n\nAvoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.","status":"published","published":"2026-05-19T16:21:33Z","modified":"2026-05-19T16:21:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2026-45740","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","status":"published","published":"2026-05-13T16:17:00.52Z","modified":"2026-06-17T10:52:31.013Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-45740","title":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","status":"published","published":"2026-05-13T14:46:02.689Z","modified":"2026-10-28T02:31:08.474698951Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"GHSA-jggg-4jg4-v7c6","title":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","description":"## Summary\n\nprotobufjs could recurse without a depth limit while expanding nested JSON descriptors through `Root.fromJSON()` and `Namespace.addJSON()`.\n\nA crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.\n\n## Impact\n\nAn attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.\n\nThis affects applications that load JSON descriptors from untrusted sources with affected versions.\n\n## Preconditions\n\n- The application must load JSON descriptor data influenced by an attacker.\n- The crafted descriptor must contain deeply nested `nested` namespace objects.\n- The affected `Root.fromJSON()` / `Namespace.addJSON()` descriptor expansion path must process the crafted input.\n\n## Workarounds\n\nAvoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.","status":"published","published":"2026-05-19T16:21:33Z","modified":"2026-09-10T03:51:06.294549383Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"ROOT-APP-NPM-CVE-2026-45740","title":"CVE-2026-45740 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:04.932454343Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1779670111","title":"TuxCare security update for protobufjs (3 CVEs)","description":"TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 6.11.6-tuxcare.3.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.584351626Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1784164061","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-30T19:45:57.267311183Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784769544","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.697524254Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785380788","title":"TuxCare security update for protobufjs (3 CVEs)","description":"TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-23T19:28:12.787611364Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785380800","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 0.12.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.87706677Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468077","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.183593535Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790770894","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.11.3-tuxcare.1.","status":"published","published":"2026-09-30T12:21:34Z","modified":"2026-10-15T09:47:41.943165086Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791362263","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.","status":"published","published":"2026-10-07T08:37:43Z","modified":"2026-10-15T09:47:58.388325645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792755967","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 7.5.4-tuxcare.3.","status":"published","published":"2026-10-23T11:46:07Z","modified":"2026-10-23T13:45:35.143131593Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}