PT-2026-49584 · Npm · Protobufjs
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
protobufjs versions prior to 8.6.0
protobufjs versions prior to 7.6.3
Description
protobufjs accepts certain schema-derived names that collide with properties used by runtime helpers. Specifically, this occurs with fields named
hasOwnProperty, field or oneof names such as $type when loaded via JSON/reflection descriptors, and service methods that generate a helper name of rpcCall. When these types are used, the software may read schema-controlled data instead of the expected own-property helper, reflected type metadata, or base RPC helper. This can lead to deterministic exceptions or recursive calls during decode post-checks, verification, object conversion, reflected JSON serialization, or RPC helper invocation, potentially resulting in a denial of service for the affected processing path.Recommendations
Update to version 8.6.0 or 7.6.3.
Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources.
If untrusted schemas must be accepted, validate and reject schema-derived field, oneof, and service method names that match the problematic names before loading.
For trusted schemas, rename affected fields or service methods, or avoid the affected API path.
Exploit
Fix
Uncontrolled Recursion
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Protobufjs