protobufjs protobuf.js up to 7.6.2/8.5.x Type recursion

Summaryinfo

A vulnerability described as problematic has been identified in protobufjs protobuf.js up to 7.6.2/8.5.x. This affects an unknown function. Such manipulation of the argument Type leads to recursion. This vulnerability is documented as CVE-2026-54269. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in protobufjs protobuf.js up to 7.6.2/8.5.x and classified as problematic. Affected by this issue is an unknown code block. The manipulation of the argument type with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. CVE summarizes:

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54269 since 06/12/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 7.6.3 or 8.6.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• JavaScript Library

Vendor

• protobufjs

Name

• protobuf.js

Version

• 7.6.0
• 7.6.1
• 7.6.2
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5

Website

• Product: https://github.com/protobufjs/protobuf.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion