CVE-2026-48712 Details
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
A denial-of-service vulnerability has been identified in protobufjs versions prior to 7.6.1 and 8.4.1. The issue arises from an unbounded recursion depth while converting decoded messages to plain objects or JSON, particularly affecting the generated 'toObject()' method and the custom 'google.protobuf.Any' JSON conversion path. This vulnerability can be exploited by a crafted protobuf binary payload containing deeply nested 'Any' values, leading to exhaustion of the JavaScript call stack during the conversion process.
Users can upgrade to protobufjs versions 7.6.1 or 8.4.1 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to avoid converting untrusted protobuf messages with 'google.protobuf.Any' values to JSON using the affected versions. Alternatively, messages with deeply nested 'Any' payloads can be rejected or limited at an outer protocol boundary, avoid JSON conversion of untrusted 'Any' values, or isolate the message conversion in a process that can be safely restarted.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs | < 7.6.1 >= 8.0.0, < 8.4.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |