CVE-2026-48712 Overview
CVE-2026-48712 is an uncontrolled recursion vulnerability [CWE-674] in protobufjs, a widely used JavaScript library that compiles Protocol Buffer (protobuf) definitions into JavaScript functions. Versions prior to 7.6.1 and 8.4.1 fail to enforce a depth limit when converting decoded protobuf messages into plain JavaScript objects or JSON. The flaw affects the generated toObject() conversion routine and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values exhausts the JavaScript call stack during conversion, terminating the host process.
Critical Impact
Remote, unauthenticated attackers can crash Node.js services that decode untrusted protobuf input, resulting in denial of service.
Affected Products
- protobufjs versions prior to 7.6.1 in the 7.x release line
- protobufjs versions prior to 8.4.1 in the 8.x release line
- Node.js and JavaScript applications that decode untrusted protobuf payloads using protobufjs
Discovery Timeline
- 2026-06-22 - CVE-2026-48712 published to the National Vulnerability Database (NVD)
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-48712
Vulnerability Analysis
The vulnerability resides in protobufjs message-to-object conversion logic. When the library encodes a decoded protobuf message into a plain JavaScript object or JSON representation, it recursively walks the message tree. The conversion routines do not impose a maximum recursion depth. An attacker who controls the binary protobuf payload can embed google.protobuf.Any values nested inside one another to arbitrary depth. Each nested Any triggers a deeper call into the conversion path, growing the JavaScript call stack until the runtime throws a RangeError: Maximum call stack size exceeded and aborts processing.
The affected paths include the auto-generated toObject() function for each compiled message type and the special-case JSON conversion logic for google.protobuf.Any, which unpacks and re-serializes wrapped message payloads.
Root Cause
The root cause is missing depth enforcement during recursive serialization. Protobuf permits arbitrarily nested wrapper messages, and the JavaScript implementation trusts the structure of decoded input. Without a guard counter, the function recurses once per nesting level until the V8 stack limit is reached.
Attack Vector
Exploitation requires only that an attacker submit a protobuf payload to a service that subsequently calls toObject() or converts the message to JSON. No authentication, user interaction, or local access is required. The result is process termination and loss of availability for any service that decodes attacker-controlled protobuf data, including API gateways, gRPC servers, and microservices.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-wcpc-wj8m-hjx6 for additional technical detail.
Detection Methods for CVE-2026-48712
Indicators of Compromise
- Repeated RangeError: Maximum call stack size exceeded exceptions in Node.js application logs originating from protobufjs toObject or JSON conversion frames.
- Unexpected process restarts or crash loops in services that ingest protobuf or gRPC traffic from external sources.
- Inbound requests with abnormally large or deeply structured google.protobuf.Any fields.
Detection Strategies
- Inventory all Node.js applications and audit package-lock.json and yarn.lock for protobufjs versions below 7.6.1 or 8.4.1, including transitive dependencies.
- Instrument protobuf decode boundaries with structured logging that captures payload size and nesting metrics.
- Add runtime alerts on unhandled RangeError exceptions tied to serialization stack frames.
Monitoring Recommendations
- Track service availability metrics and crash counts for any API endpoint that accepts protobuf input.
- Monitor request payload size distributions and flag outliers that exceed normal protobuf message sizes.
- Forward Node.js runtime errors and process exit events into centralized logging for correlation across replicas.
How to Mitigate CVE-2026-48712
Immediate Actions Required
- Upgrade protobufjs to 7.6.1 or 8.4.1 across all affected applications and rebuild deployment artifacts.
- Identify transitive dependencies on vulnerable protobufjs versions using npm ls protobufjs and pin direct overrides where upstream packages have not yet upgraded.
- Restart services after deployment to ensure the patched library is loaded into the runtime.
Patch Information
The vulnerability is fixed in protobufjs 7.6.1 and 8.4.1. Both releases add depth tracking to the recursive conversion paths used by toObject() and the google.protobuf.Any JSON converter. Patch details are available in the GitHub Security Advisory GHSA-wcpc-wj8m-hjx6.
Workarounds
- Reject inbound protobuf payloads that exceed a conservative size threshold before invoking decode logic.
- Validate and constrain the use of google.protobuf.Any in public-facing schemas, or strip nested Any values prior to JSON conversion.
- Wrap toObject() and JSON conversion calls in try/catch blocks that contain RangeError exceptions and prevent process termination while patching is in progress.
# Configuration example: upgrade protobufjs across the 7.x and 8.x branches
npm install protobufjs@^8.4.1
# or, for projects pinned to the 7.x line
npm install protobufjs@^7.6.1
# verify installed versions and surface vulnerable transitive copies
npm ls protobufjs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
