protobuf.js CVE-2026-48712 DoS via unbounded Any expansion in JSON conversion

Vulnerability Overview Vulnerability Name: Denial of service through unbounded Any expansion during JSON conversion Vulnerability Description: protobuf.js lacks depth limits when decoding messages into plain objects or JSON, leading to vulnerabilities in the generated conversion and custom JSON conversion paths. An attacker can craft a protobuf binary payload with deep nesting, causing the JavaScript call stack to exhaust during conversion. Impact Scope Affected Versions: - - Fixed Versions: - - CVSS Score: 7.5 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High Remediation 1. Avoid Conversion: Avoid converting untrusted protobuf messages containing values to JSON. 2. Isolate Processing: If an immediate upgrade is not possible, isolate messages at external protocol boundaries to avoid JSON conversion of untrusted values, or isolate message conversion during safe restart processes. Preconditions The application must decode protobuf binary data influenced by the attacker. The application schema must include , and the referenced must resolve to a message type in the loaded protobuf root. The application must convert the decoded message to JSON or a plain object via an affected conversion path. The crafted input must contain deeply nested values that expand during conversion. Workarounds Avoid converting values contained in untrusted protobuf messages to JSON. If an immediate upgrade is not possible, isolate messages at external protocol boundaries to avoid JSON conversion of untrusted values, or isolate message conversion during safe restart processes. Additional Information CVE ID: CVE-2026-48712 Weaknesses: No CWE Contributors: - EchoSko2j (Reporter) - yueyueL (Reporter) - dcodeIO (Remediation developer) Summary This vulnerability involves a lack of depth limits for values in protobuf.js, potentially leading to a denial of service attack. Affected versions are and , with fixed versions and . It is recommended to avoid converting untrusted values or to isolate their processing.

Goal Reached Thanks to every supporter — we hit 100%!

protobuf.js CVE-2026-48712 DoS via unbounded Any expansion in JSON conversion

More from this source