Two vulnerabilities have been identified in the protobufjs npm package. These vulnerabilities involve a denial-of-service condition via an infinite loop and a prototype pollution flaw within the text format extension. If exploited, these issues could allow attackers to disrupt service availability by blocking the event loop or manipulate object properties to influence downstream logic. Organizations utilizing this library to parse untrusted data face significant risks to service continuity and data integrity.
CVE-2026-59877 (CVSS 5.3 — Medium): A crafted.proto schema can cause the option parser to loop without terminating, resulting in a denial-of-service attack. The affected component is the reflection parsing path, including parse, Root.load, and Root.loadSync methods.[/subscribe_to_unlock_form]
Two vulnerabilities have been identified in the protobufjs npm package. These vulnerabilities involve a denial-of-service condition via an infinite loop and a prototype pollution flaw within the text format extension. If exploited, these issues could allow attackers to disrupt service availability by blocking the event loop or manipulate object properties to influence downstream logic. Organizations utilizing this library to parse untrusted data face significant risks to service continuity and data integrity.
CVE-2026-59877 (CVSS 5.3 — Medium): A crafted.proto schema can cause the option parser to loop without terminating, resulting in a denial-of-service attack. The affected component is the reflection parsing path, including parse, Root.load, and Root.loadSync methods.[emaillocker id="1283"]
CVE-2026-59876 (CVSS 4.8 — Medium): An attacker-controlled protobuf Text Format input can mutate the returned map object prototype, allowing for per-object prototype mutation. This affects the optional Text Format extension and is not directly related to binary decode or other input paths.
We recommend you to update protobufjs to below version: https://github.com/protobufjs/protobuf.js/releases
The following reports contain further technical details:
[/emaillocker]