CVE-2026-59877: protobufjs Denial of Service Vulnerability

CVE-2026-59877 Overview

CVE-2026-59877 is a denial-of-service vulnerability in protobufjs, a widely used library that compiles Protocol Buffer (protobuf) definitions into JavaScript functions. Versions prior to 7.6.5 and 8.6.6 fail to validate end-of-input conditions while parsing option names in .proto schema files. A crafted schema that opens an option declaration and terminates prematurely causes parse, Root.load, or Root.loadSync to enter an infinite loop. This is classified as an infinite loop weakness [CWE-835]. The issue is fixed in versions 7.6.5 and 8.6.6.

Critical Impact
An attacker who can supply a malicious .proto schema to an application using vulnerable protobufjs can hang the parsing thread, resulting in CPU exhaustion and denial of service.

Affected Products

protobufjs versions prior to 7.6.5 (7.x branch)
protobufjs versions prior to 8.6.6 (8.x branch)
Node.js and JavaScript applications that dynamically load untrusted .proto schemas via parse, Root.load, or Root.loadSync

Discovery Timeline

2026-07-08 - CVE-2026-59877 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59877

Vulnerability Analysis

The defect resides in the schema tokenizer used by protobufjs when it encounters an option declaration inside a .proto file. The parser advances through tokens searching for the = delimiter that separates an option name from its value. It relies on the assumption that the token stream will eventually yield either = or another valid syntax element.

When the schema truncates in the middle of an option declaration, the tokenizer returns null to signal end of input. The affected code never inspects this sentinel, so the while (token !== "=") loop never terminates. The event loop of the calling Node.js process becomes blocked, consuming CPU and preventing further request processing.

Root Cause

The root cause is missing end-of-input validation in src/parse.js. The parser trusts that every option declaration is well-formed and closes with =. There is no guard for a null token, which the lexer emits when the input is exhausted. This is a classic infinite loop condition triggered by untrusted input.

Attack Vector

Exploitation requires the target application to parse a .proto schema supplied or influenced by an attacker. Any service that ingests protobuf schemas from user uploads, remote registries, or third-party plugins is a candidate. No authentication, privileges, or user interaction are required when the parsing path is reachable over the network.

javascript

// Patch applied to src/parse.js
// Source: https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f

            while (token !== "=") {
                if (token === null) {
                    throw illegal(token, "end of input");
                }
                if (token === "(") {
                    var parensValue = next();
                    skip(")");

The fix adds an explicit null check before continuing the loop. When the lexer signals end of input, the parser now throws an illegal token error instead of spinning indefinitely. See the GitHub Security Advisory GHSA-j3f2-48v5-ccww for the coordinated disclosure details.

Detection Methods for CVE-2026-59877

Indicators of Compromise

Node.js worker processes stuck at 100% CPU utilization with the call stack rooted in protobufjs/src/parse.js.
HTTP requests or job handlers that never return when processing a .proto schema upload.
Application logs showing repeated timeouts against endpoints that invoke protobuf.parse, Root.load, or Root.loadSync.

Detection Strategies

Inventory JavaScript and Node.js dependencies using Software Composition Analysis (SCA) tools and flag protobufjs versions below 7.6.5 or 8.6.6.
Review application code paths that pass externally-sourced .proto content into protobufjs parsing APIs.
Correlate CPU spike events with request identifiers to isolate schemas that trigger nonterminating parsing.

Monitoring Recommendations

Enforce per-request execution timeouts on any handler that invokes protobufjs parsing functions.
Track sustained single-core CPU saturation on Node.js runtimes as a proxy signal for algorithmic denial of service.
Alert on truncated or malformed .proto uploads and quarantine the associated payloads for review.

How to Mitigate CVE-2026-59877

Immediate Actions Required

Upgrade protobufjs to 7.6.5 on the 7.x branch or 8.6.6 on the 8.x branch.
Audit direct and transitive dependencies with npm ls protobufjs or yarn why protobufjs to locate every install location.
Restrict schema ingestion to trusted sources until upgraded builds are deployed.

Patch Information

The vulnerability is resolved in protobufjs 7.6.5 and protobufjs 8.6.6. The fixes were merged through Pull Request 2352 and are visible in commits fa5c73a and 10fba6d.

Workarounds

Wrap parsing calls in a worker thread or child process with a hard wall-clock timeout so a runaway parse can be terminated.
Validate .proto inputs against a size limit and reject files that do not terminate cleanly before invoking the parser.
Disable dynamic schema loading and precompile trusted .proto definitions at build time where feasible.

bash

# Upgrade protobufjs to a patched release
npm install protobufjs@^8.6.6
# Or for projects pinned to the 7.x branch
npm install protobufjs@^7.6.5

# Verify no vulnerable versions remain in the dependency tree
npm ls protobufjs