[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
protobufjs@<7.5.5	^7.5.8 → ^7.5.9

---

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

CVE-2026-48712 / GHSA-wcpc-wj8m-hjx6

More information

Details

Summary

protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path.

A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON.

Impact

An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.

This affects applications that decode untrusted protobuf input containing google.protobuf.Any values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through JSON.stringify(message), Message#toJSON(), or Type.toObject(message, { json: true }).

Applications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.

Preconditions

• The application must decode protobuf binary data influenced by an attacker.
• The application schema must include google.protobuf.Any, and the referenced type_url must resolve to a message type in the loaded protobuf root.
• The application must convert the decoded message to JSON or a plain object through an affected conversion path.
• The crafted input must contain deeply nested Any values that are expanded during conversion.

Workarounds

Avoid converting untrusted protobuf messages containing google.protobuf.Any values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested Any payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted Any values, or isolate message conversion in a process that can be safely restarted.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6
• https://nvd.nist.gov/vuln/detail/CVE-2026-48712
• https://github.com/protobufjs/protobuf.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

protobufjs : Schema-derived names can shadow runtime-significant properties

CVE-2026-54269 / GHSA-f38q-mgvj-vph7

More information

Details

Summary

protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall.

When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation.

Impact

An attacker who can provide or influence protobuf schemas or protobufjs JSON descriptors may be able to make affected message or service types unusable, resulting in denial of service for the affected processing path.

Applications using only trusted schemas are affected only if those schemas contain one of the problematic names and the application reaches the affected API path.

The issue is not known to allow code execution by itself.

Preconditions

• The application must use an affected protobufjs version.
• The application must load or use a schema or protobufjs JSON descriptor containing one of the problematic names:
  • a field named hasOwnProperty,
  • a field or oneof named $type through protobufjs JSON/reflection descriptor input,
  • or a service method whose generated helper name is rpcCall.
• The application must reach the affected API path for that name: required-field decode post-checks, verify, or toObject for hasOwnProperty; reflected message JSON serialization for $type; or protobufjs RPC service invocation for rpcCall.

Workarounds

Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources with affected versions. If untrusted schemas or descriptors must be accepted, validate schema-derived field, oneof, and service method names before loading and reject the problematic names described above.

Applications using trusted schemas can avoid the issue by renaming affected fields or service methods, or by avoiding the affected API path.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7
• https://nvd.nist.gov/vuln/detail/CVE-2026-54269
• https://github.com/protobufjs/protobuf.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

protobufjs: Denial of Service via infinite loop in .proto option parsing

CVE-2026-59877 / GHSA-j3f2-48v5-ccww

More information

Details

Summary

protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.

This affects the reflection parsing path (parse, Root.load, Root.loadSync).

Impact

An attacker who can provide or influence .proto schema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated.

Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected.

Preconditions

• The application must parse .proto schema text influenced by an attacker.
• The schema must be parsed through APIs such as parse, Root.load, or Root.loadSync.
• The crafted input must begin an option declaration that ends before its = assignment.

Workarounds

Do not parse .proto schemas from untrusted sources with affected versions. If untrusted schema text must be accepted, isolate parsing in a process or worker that can be safely terminated and bound it with a timeout, so a non-returning parse call cannot deny service to the rest of the application.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww
• https://nvd.nist.gov/vuln/detail/CVE-2026-59877
• https://github.com/protobufjs/protobuf.js/pull/2352
• https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
• https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
• https://github.com/protobufjs/protobuf.js
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

protobufjs/protobuf.js (protobufjs@<7.5.5)

v7.5.9: protobufjs: v7.5.9

Compare Source

Bug Fixes

• Backport bundler-safe optional module lookups (#​2254) (0853a62)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.