Vulnerability Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Protobufjs Project | Protobufjs | < 7.6.5 |
Related Weaknesses (CWE)
References
- https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490Patch
- https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f372Patch
- https://github.com/protobufjs/protobuf.js/pull/2352Issue TrackingPatch
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5ProductRelease Notes
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6ProductRelease Notes
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccwMitigationVendor Advisory
FAQ
What is CVE-2026-59877?
CVE-2026-59877 is a vulnerability with a CVSS score of 5.3 (MEDIUM). protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without c...
How severe is CVE-2026-59877?
CVE-2026-59877 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59877?
Check the references section above for vendor advisories and patch information. Affected products include: Protobufjs Project Protobufjs.