CVE-2026-59877

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6

Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reached without verifying the end of the input. Consequently, a specially crafted .proto schema that opens an option declaration and ends prematurely can cause the parse(), Root.load(), or Root.loadSync() functions to loop indefinitely.

Recommendations Update protobufjs to version 7.6.5 or later. Update protobufjs to version 8.6.6 or later.