CVE-2026-59877: protobufjs Infinite Loop in Schema Parsing

Technical summary

The vulnerability exists in protobufjs's option parsing logic. When processing protobuf schema files, the parser advances through tokens while searching for an equals sign (=) to mark the end of an option declaration. However, the code does not validate whether the input has ended before this equals sign is found. A specially crafted .proto file that begins an option declaration but terminates prematurely—without providing the expected equals token—causes the parser to loop indefinitely while continuing to search. This affects the parse(), Root.load(), and Root.loadSync() functions. The issue is rooted in CWE-835 (Loop with Unreachable Exit Condition), a class of defects where control flow cannot escape a loop due to missing or incorrect termination checks.

Business impact

Applications relying on protobufjs to parse .proto schemas from untrusted or user-supplied sources face availability risk. An attacker could submit a malicious schema file that freezes the application during schema loading, resulting in denial of service. Development pipelines that automatically ingest and validate protobuf definitions, microservices that dynamically load schemas, or any build system that processes .proto files without strict input validation are at risk. The impact is localized to availability; confidentiality and integrity are not affected.

Affected systems

protobufjs versions 7.x prior to 7.6.5 and versions 8.x prior to 8.6.6 are vulnerable. Any application or service using these versions to load .proto schema files is potentially affected, particularly those that process schemas from external or untrusted sources. The library is widely used in JavaScript ecosystems, including Node.js backends, build tools, and development environments.

Exploitability

Exploitation requires only the ability to supply a malformed .proto file to an application using the vulnerable library. No authentication, special privileges, or user interaction is required if the application loads schemas automatically or from attacker-controlled sources. The attack surface depends on how the application consumes .proto files: web-based schema validators, file upload features, or automated schema ingestion are higher-risk scenarios. Crafting the malicious schema is trivial—a simple incomplete option declaration suffices.

Remediation

Upgrade protobufjs to version 7.6.5 or later for the 7.x branch, or version 8.6.6 or later for the 8.x branch. Review your dependency management tooling (npm, yarn, pnpm) to identify affected packages. If your application loads .proto schemas from untrusted sources, consider implementing additional input validation or sandboxing measures while you stage and test the upgrade.

Patch guidance

Update your package.json or lock file to require protobufjs ≥7.6.5 for 7.x users or ≥8.6.6 for 8.x users. Run npm update (or equivalent) and test thoroughly in a development environment before deploying to production. Verify that your application's schema loading paths continue to function correctly post-upgrade. No breaking changes are documented in the patch releases, so upgrades should be safe. Consult the protobufjs release notes to confirm compatibility with your specific usage patterns.

Detection guidance

Monitor your dependency trees using tools like npm audit or Snyk to flag protobufjs versions below 7.6.5 or 8.6.6. If your application logs schema loading operations, watch for unresponsive or hung processes during .proto parsing, which may indicate an attack attempt. Consider implementing timeouts around schema loading operations to catch infinite loops and fail gracefully. Runtime process monitoring can detect CPU spinning or memory stalling during parse operations.

Why prioritize this

Although the CVSS score is moderate (5.3), prioritize this for rapid remediation because (1) the attack vector is network-accessible with no authentication required, (2) exploitation is trivial, (3) affected libraries are widely deployed, and (4) availability disruptions can cascade. Organizations that accept .proto files from users or external systems should patch immediately.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects an availability-only impact with low attack complexity and no authentication requirement. The AV:N/AC:L/PR:N parameters indicate the attack is feasible from the network with minimal prerequisites. The absence of confidentiality or integrity impact caps the score below 7.0. However, the practical risk may be higher for applications with tight SLAs or those that depend on continuous schema availability, warranting prioritization beyond the base CVSS number.

Frequently asked questions