Back to overview

CVE-2026-48712

HIGH
7.5
CVSS 3.1
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

Metadata

CVE ID
CVE-2026-48712
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-22 18:47 UTC
Published
2026-06-22 16:21 UTC
Last updated
2026-06-22 16:21 UTC
Primary CWE
CWE-674
CWE-674: Uncontrolled Recursion
Vendor / Product
protobufjs / protobuf.js
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
protobufjs protobuf.js — < 7.6.1, >= 8.0.0, < 8.4.1
Weakness (CWE)
CWESourceDescription
CWE-674 cna CWE-674: Uncontrolled Recursion
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (1)
Back to overview