PT-2026-56497 · Protobufjs · Protobufjs

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-59877

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2026-59877

Produtos afetados

Protobufjs

Referências · 7

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww · Nota
• https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f · Nota
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5 · Nota
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6 · Nota
• https://github.com/protobufjs/protobuf.js/pull/2352 · Nota
• https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59877 · Nota de Segurança