CVE-2026-48712: protobufjs Stack Exhaustion via Recursive Nesting - Denial of Service

Technical summary

The vulnerability exists in protobufjs's toObject() conversion logic and the specialized JSON conversion handler for google.protobuf.Any messages. When processing a crafted protobuf binary containing recursively nested Any values, the conversion functions do not enforce a depth limit on their recursive calls. This allows an attacker-supplied payload to exceed the JavaScript engine's call stack limit (RangeError: Maximum call stack size exceeded), resulting in a process crash. The flaw affects both the major version 7 (before 7.6.1) and version 8 (before 8.4.1) branches. Applications using protobufjs to deserialize messages from external sources and then convert them to JSON representation are most at risk.

Business impact

Organizations relying on protobufjs-based services for API gateways, message processing, microservices, or real-time data platforms face availability risk. An attacker requires only the ability to send a specially crafted protobuf message to crash backend processes, potentially affecting service availability without authentication. For services deployed in auto-scaling environments, this could trigger repeated instance failures and incur operational costs. No data confidentiality or integrity impact occurs; the attack is purely a denial-of-service vector.

Affected systems

protobufjs versions 7.0.0 through 7.6.0 (inclusive) and versions 8.0.0 through 8.4.0 (inclusive) are vulnerable. Any application or service using affected versions of protobufjs to process protobuf messages is at risk, particularly those that: expose protobuf deserialization endpoints to untrusted network input, use google.protobuf.Any message types, or automatically convert deserialized messages to JSON for logging, API responses, or storage. Node.js applications, browser-based WebAssembly applications, and gRPC services are common deployment contexts.

Exploitability

Exploitation requires only network access to an application accepting protobuf input and no authentication or user interaction. The attack surface is high for services exposing gRPC endpoints, message brokers, or APIs that accept protobuf payloads. Crafting the malicious payload is straightforward—an attacker must generate a protobuf message with nested Any values exceeding the JavaScript call stack depth (typically 10,000–15,000 levels depending on the runtime). No special tools or reverse engineering is required. However, the vulnerability does not grant code execution or data access; it only degrades availability.

Remediation

Upgrade protobufjs to version 7.6.1 or later for the v7 branch, or version 8.4.1 or later for the v8 branch. These releases introduce recursion depth limits in the toObject() and Any JSON conversion code paths. Verify the fixed versions in your package.json or package-lock.json after upgrading, and test that your application's protobuf deserialization and JSON conversion workflows function correctly. For organizations unable to upgrade immediately, implement network-level protobuf message size and complexity validation as a temporary mitigation.

Patch guidance

1. Update protobufjs in your dependency tree to 7.6.1+ or 8.4.1+. 2. Use npm audit to confirm the update resolves the identified vulnerability. 3. Regenerate protobuf JavaScript bindings if using a build step (protoc compiler with protobufjs plugin). 4. Conduct integration testing of any services that deserialize protobuf and convert to JSON to ensure the recursion limits do not reject legitimate deeply nested payloads (unlikely but possible in edge cases). 5. Redeploy and monitor for any unexpected errors during the rollout.

Detection guidance

Monitor for JavaScript RangeError exceptions specifically mentioning 'Maximum call stack size exceeded' in logs from applications using protobufjs. Set up alerts on process crashes or restarts in protobufjs-dependent services. In gRPC logs, watch for sudden connection resets or service unavailability correlated with specific message receipt. Network-level intrusion detection can flag unusually nested or large protobuf payloads sent to known gRPC or protobuf-accepting endpoints. Implement input validation to reject protobuf messages exceeding a reasonable nesting depth threshold before they reach the protobufjs library.

Why prioritize this

HIGH CVSS (7.5) reflects a remotely exploitable, unauthenticated denial-of-service vulnerability with high attack complexity. Although not yet in CISA's KEV catalog, the ease of exploitation and broad use of protobufjs in modern microservice architectures make this a near-term risk. Organizations running gRPC services, message queues, or APIs that accept external protobuf input should prioritize patching within 30 days. Lower priority for applications that only deserialize protobuf from fully trusted internal sources.

Risk score, explained

CVSS 7.5 (HIGH) is justified by: Network accessibility (AV:N), no authentication required (PR:N), no special user interaction (UI:N), and high availability impact (A:H). The score reflects the ease of triggering a denial-of-service condition. No confidentiality (C:N) or integrity (I:N) impacts reduce the score from Critical. The vulnerability is not in the CISA KEV list yet, so exploit code in the wild is unknown; however, PoC development is trivial, warranting prompt patching.

Frequently asked questions