CVE-2026-45740: protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Summary
protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().
A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.
Impact
An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.
This affects applications that load JSON descriptors from untrusted sources with affected versions.
Preconditions
- The application must load JSON descriptor data influenced by an attacker. - The crafted descriptor must contain deeply nested nested namespace objects. - The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.
Workarounds
Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.
Other sources
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/protobufjsto a version that resolves this vulnerability.Fixed in 8.2.0 - Upgrade
Upgrade
npm/protobufjsto a version that resolves this vulnerability.Fixed in 7.5.8 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.8 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.2.0 - Configuration
If immediate upgrade is not possible, reject overly deep JSON descriptor structures at an outer validation boundary where feasible (limit the depth of `nested` namespace objects).
JSON descriptor ingestion (outer validation boundary) maximum allowed nesting depth for `nested` namespace objects = reject excessively nested descriptor structures - Compensating control
Avoid loading untrusted protobuf JSON descriptors with affected versions.
- Compensating control
Isolate descriptor loading in a process that can be safely restarted.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45740?
CVE-2026-45740 is classified as a denial of service vulnerability.
How do I fix CVE-2026-45740?
To fix CVE-2026-45740, upgrade protobufjs to version 7.5.8 or later, or 8.2.0 or later.
What are the affected versions for CVE-2026-45740?
CVE-2026-45740 affects protobufjs versions prior to 7.5.8 and 8.2.0.
What type of vulnerability is CVE-2026-45740?
CVE-2026-45740 is a vulnerability that allows for unbounded recursive JSON descriptor expansion.
Who is affected by CVE-2026-45740?
Developers and applications using vulnerable versions of protobufjs to process JSON descriptors are affected by CVE-2026-45740.