PT-2026-49585 · Npm · Protobufjs
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
protobufjs versions 8.2.0 through 8.4.2
Description
protobufjs preserves unknown wire elements in
message.$unknowns during binary decode but lacks a decode-time option to discard these fields before retention. A crafted protobuf payload containing numerous unknown fields can cause a decoded message to consume significantly more memory than the original input size. This can increase memory pressure, degrade availability, or lead to process termination in services that decode and retain attacker-controlled messages.Recommendations
For versions 8.2.0 through 8.4.2, update to version 8.5.0 or newer and disable unknown-field preservation by creating a
Reader and setting reader.discardUnknown = true, or set Reader.discardUnknown = true as the default for subsequent readers.
Update to version 8.6.2 or newer to have unknown fields discarded by default.
Enforce input-size, request concurrency, and request timeout limits at the transport or application boundary.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Protobufjs