CVEFinder.io

CVE-2026-48712

⚠️ high
Summary

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

CVSS Score
7.5
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-06-22
First Seen: 2026-06-25
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,968 vulnerabilities in our database.

#117,981
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 23, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-26
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-674

📦 Affected Products 2

Vendor Product Status Affected Versions
protobufjs_project protobufjs Affected
< 7.6.1
protobufjs_project protobufjs Affected
> 8.0.0 < 8.4.1

🔗 References 1

https://github.com/protobufjs/protobuf.js/security/a...
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-59876 🔶 medium 4.8 0.2 protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text For... 2026-07-08
CVE-2026-59877 🔶 medium 5.3 0.4 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed opt... 2026-07-08
CVE-2026-54269 🔶 medium 5.3 0.2 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted c... 2026-06-22
CVE-2026-54270 🔶 medium 5.3 0.3 protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unkno... 2026-06-22
CVE-2026-44290 ⚠️ high 7.5 0.1 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed ce... 2026-05-13
CVE-2026-44291 ⚠️ high 8.1 0.1 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain... 2026-05-13
These CVEs affect the same products