CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-45740
High (7.5) in protobufjs project protobufjs. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in protobufjs 7.5.8, 8.2.0.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
- CWE
- CWE-674
- Published
- Modified
- Record from
- the NVD, synced
Affected
- protobufjs_project:protobufjs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jggg-4jg4-v7c6 | npm | protobufjs | <7.5.8 | 7.5.8 |
| GHSA-jggg-4jg4-v7c6 | npm | protobufjs | >=8.0.0 <8.2.0 | 8.2.0 |