Vulnerability Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Protobufjs Project | Protobufjs | < 7.6.1 |
Related Weaknesses (CWE)
References
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjxMitigationVendor Advisory
FAQ
What is CVE-2026-48712?
CVE-2026-48712 is a vulnerability with a CVSS score of 7.5 (HIGH). protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or ...
How severe is CVE-2026-48712?
CVE-2026-48712 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48712?
Check the references section above for vendor advisories and patch information. Affected products include: Protobufjs Project Protobufjs.