CVE-2026-45740CWE-674

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Medium · published May 13, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-05-13T14:46Z
EPSS history
Timeline
  • 13 MAY 14:46Z
    protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
    cvelistv5