CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217	Patch
https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f	Patch
https://github.com/protobufjs/protobuf.js/pull/2352	Issue Tracking Patch
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5	Product Release Notes
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6	Product Release Notes
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:protobufjs_project:protobufjs::::::node.js::*
	cpe:2.3:a:protobufjs_project:protobufjs::::::node.js::*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) protobufjs compila definiciones de protobuf en funciones de JavaScript (JS). Antes de las versiones 7.6.5 y 8.6.6, protobufjs analizaba los nombres de las opciones avanzando a través de los tokens del esquema hasta alcanzar un token ’=’ sin verificar el final de la entrada, por lo que un esquema .proto manipulado que abre una declaración de opción y termina prematuramente puede causar que parse, Root.load o Root.loadSync entren en un bucle indefinido. Este problema está corregido en las versiones 7.6.5 y 8.6.6.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59877

Mitre link : CVE-2026-59877

CVE.ORG link : CVE-2026-59877

JSON object : View

Products Affected

protobufjs_project

protobufjs

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-59877", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59877", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T15:48:58.903197Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "protobufjs", "product": "protobuf.js", "versions": [{"status": "affected", "version": ">= 7.5.0, < 7.6.5"}, {"status": "affected", "version": ">= 8.0.0, < 8.6.6"}]}]}], "published": "2026-07-08T16:16:34.363", "references": [{"url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/pull/2352", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6."}, {"lang": "es", "value": "protobufjs compila definiciones de protobuf en funciones de JavaScript (JS). Antes de las versiones 7.6.5 y 8.6.6, protobufjs analizaba los nombres de las opciones avanzando a trav\u00e9s de los tokens del esquema hasta alcanzar un token \u2019=\u2019 sin verificar el final de la entrada, por lo que un esquema .proto manipulado que abre una declaraci\u00f3n de opci\u00f3n y termina prematuramente puede causar que parse, Root.load o Root.loadSync entren en un bucle indefinido. Este problema est\u00e1 corregido en las versiones 7.6.5 y 8.6.6."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CE56DEAB-0C12-4D27-B6A9-9594122EB93F", "versionEndExcluding": "7.6.5"}, {"criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0859CC9A-187E-4D68-9D7B-B5F1E4AC3A9F", "versionEndExcluding": "8.6.6", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}