CVE-2026-45740

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.8 protobufjs versions prior to 8.2.0

Description protobufjs compiles protobuf definitions into JavaScript functions. The software can recurse without a depth limit when expanding nested JSON descriptors through the Root.fromJSON() and Namespace.addJSON() functions. A crafted JSON descriptor containing deeply nested namespace definitions can exhaust the JavaScript call stack during descriptor loading, leading to a denial of service.

Recommendations Update to version 7.5.8. Update to version 8.2.0.