CVE-2026-59877
1 advisory.
npm/protobufjs CVE-2026-59877: medium 5.3, EPSS 0.36%
protobufjs: Denial of Service via infinite loop in .proto option parsing
Action: Upgrade protobufjs to 7.6.5 or later.
npm i protobufjs@7.6.5npm i protobufjs@8.6.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.5.0 | 7.6.5 | - |
| 8.0.0 | 8.6.6 | - |
Fixed versions
| 7.6.5 | 8.6.6 |
Sources
- osv: GHSA-j3f2-48v5-ccww
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww
- https://nvd.nist.gov/vuln/detail/CVE-2026-59877
- https://github.com/protobufjs/protobuf.js/pull/2352
- https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
- https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
- https://github.com/protobufjs/protobuf.js
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
CVE-2026-59877 · published · modified · JSON