PT-2026-40697 · Npm · Protobufjs

Published 2026-05-13 · Updated 2026-05-19 · CVE-2026-45740

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.8 protobufjs versions prior to 8.2.0

Description protobufjs compiles protobuf definitions into JavaScript functions. The software can recurse without a depth limit when expanding nested JSON descriptors through the Root.fromJSON() and Namespace.addJSON() functions. A crafted JSON descriptor containing deeply nested namespace definitions can exhaust the JavaScript call stack during descriptor loading, leading to a denial of service.

Recommendations Update to version 7.5.8. Update to version 8.2.0.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-45740

GHSA-JGGG-4JG4-V7C6

Affected Products

Protobufjs

References · 6

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45740 · Security Note
• https://osv.dev/vulnerability/GHSA-jggg-4jg4-v7c6 · Vendor Advisory
• https://github.com/protobufjs/protobuf.js · Note
• https://reddit.com/r/VulnMatter/comments/1ths5us/resumen_diario_de_vulnerabilidades_19052026 · Reddit Post
• https://t.me/CVEtracker/53675 · Telegram Post