CVE-2026-59877 Details

A denial-of-service vulnerability has been identified in protobufjs versions 7.5.0 prior to 7.6.5 and 8.0.0 prior to 8.6.6. The issue arises in the reflection parsing path when the library processes option names in .proto schemas. The parser advances through schema tokens looking for an '=' token, but fails to check for the end of input. This oversight allows a crafted schema to open an option declaration and then end prematurely, causing the parser to enter an infinite loop. As a result, the blocked event loop halts all other operations in the Node.js process, leading to a denial-of-service condition that persists until the process is manually terminated.

Users can upgrade to protobufjs versions 7.6.5 or 8.6.6, both of which include the necessary fix. If untrusted schema text must be parsed, it is recommended to do so in a separate process or worker that can be terminated if it does not complete, and to set a timeout to prevent denial-of-service conditions.