CVE-2026-45740
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Description
## Summary protobufjs could recurse without a depth limit while expanding nested JSON descriptors through `Root.fromJSON()` and `Namespace.addJSON()`. A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. ## Impact An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow. This affects applications that load JSON descriptors from untrusted sources with affected versions. ## Preconditions - The application must load JSON descriptor data influenced by an attacker. - The crafted descriptor must contain deeply nested `nested` namespace objects. - The affected `Root.fromJSON()` / `Namespace.addJSON()` descriptor expansion path must process the crafted input. ## Workarounds Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.
How to fix CVE-2026-45740
To remediate CVE-2026-45740, upgrade the affected package to a fixed version below.
- —upgrade to 7.5.8 or later
Is CVE-2026-45740 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 7.5.8