Medium severity5.3OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-59877
CVE-2026-59877
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
protobufjsnpm | >= 7.5.0, < 7.6.5 | 7.6.5 |
protobufjsnpm | >= 8.0.0, < 8.6.6 | 8.6.6 |
Affected products
24protobufjs-v7.6.4, protobufjs-v8.6.5, protobufjs-cli-v2.5.6, …+ 2 more
- (no CPE)range: protobufjs-v7.6.4, protobufjs-v8.6.5, protobufjs-cli-v2.5.6, …
- cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*range: <7.6.5
- (no CPE)range: <7.6.5, <8.6.6
- osv-coords21 versionspkg:apk/chainguard/cadence-webpkg:apk/chainguard/homepagepkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/librechatpkg:apk/chainguard/nemopkg:apk/chainguard/opentelemetry-auto-instrumentations-nodepkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/thingsboard-tb-js-executor-fipspkg:apk/chainguard/vitess-24pkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/vitess-24
< 4.0.16-r2+ 20 more
- (no CPE)range: < 4.0.16-r2
- (no CPE)range: < 1.13.2-r5
- (no CPE)range: < 2.11.0-r30
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 3.222.0-r0
- (no CPE)range: < 3.222.0-r0
- (no CPE)range: < 0.8.7-r5
- (no CPE)range: < 2.7.3-r14
- (no CPE)range: < 0.79.0-r0
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 4.3.1.3-r3
- (no CPE)range: < 24.0.2-r6
- (no CPE)range: < 2.11.0-r30
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 24.0.2-r6
Patches
Vulnerability mechanics
References
8- github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217nvdPatchWEB
- github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69fnvdPatchWEB
- github.com/protobufjs/protobuf.js/pull/2352nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-j3f2-48v5-ccwwghsaADVISORY
- github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccwwnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-59877ghsaADVISORY
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5nvdProductRelease NotesWEB
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.