5.3
Moyenne
CVE-2026-59877 protobufjs compiles protobuf definitions into JavaScript (JS) functions
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| protobuf.js 8.0 | 8.0.0 → < 8.6.6 | 8.6.6 |
| protobuf.js 7.5 | 7.5.0 → < 7.6.5 | 7.6.5 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de protobuf.js
Les 16 CVE de protobuf.js →
CVE-2026-59876
protobufjs compiles protobuf definitions into JavaScript (JS) functions
4.8
Moyenne
CVE-2026-54269
protobufjs compiles protobuf definitions into JavaScript (JS) functions
5.3
Moyenne
CVE-2026-48712
protobufjs compiles protobuf definitions into JavaScript (JS) functions
7.5
Élevée
CVE-2026-54270
protobufjs compiles protobuf definitions into JavaScript (JS) functions
5.3
Moyenne