CVE-2026-59877 is a medium-severity (CVSS 5.3) CWE-835 vulnerability in protobufjs. A fix is available for protobufjs — see the affected versions and patch details below.
protobufjs: Denial of Service via infinite loop in .proto option parsing
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-59877.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-59877 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 384,534 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
protobufjsnpmDescription
Summary
protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.
This affects the reflection parsing path (parse, Root.load, Root.loadSync).
Impact
An attacker who can provide or influence .proto schema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated.
Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected.
Preconditions
- The application must parse
.protoschema text influenced by an attacker. - The schema must be parsed through APIs such as
parse,Root.load, orRoot.loadSync. - The crafted input must begin an option declaration that ends before its
=assignment.
Workarounds
Do not parse .proto schemas from untrusted sources with affected versions. If untrusted schema text must be accepted, isolate parsing in a process or worker that can be safely terminated and bound it with a timeout, so a non-returning parse call cannot deny service to the rest of the application.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | protobufjs | ≥ 7.5.0&&< 7.6.5 | 7.6.5npm install protobufjs@7.6.5 |
| 📦npm | protobufjs | ≥ 8.0.0&&< 8.6.6 | 8.6.6npm install protobufjs@8.6.6 |
Affected Products
protobufjsprotobufjs_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for protobufjs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update protobufjs to 7.6.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-59877 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important…
Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute…Source: Red Hat security advisory for CVE-2026-59877 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Cryostat 4 on RHEL 9 | cryostat/cryostat-grafana-dashboard-rhel9:4.2.0-14 | RHSA-2026:68333 |
| Red Hat Enterprise Linux 10 | rh-podman-desktop-0:1.1.2-1.el10_2 | RHSA-2026:57590 |
| Red Hat Ansible Automation Platform 2.1 | ansible-automation-platform/automation-portal:1785854226 | RHSA-2026:50850 |
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/automation-portal:1785857303 | RHSA-2026:50839 |
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/bootc-automation-portal-rhel9:1786006573 | RHSA-2026:51162 |
| Red Hat Ansible Automation Platform 2.6 | ansible-automation-platform-26/gateway-rhel9:1789666472 | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | ansible-automation-platform-27/gateway-rhel9:1788918510 | RHSA-2026:67279 |
| Red Hat Developer Hub 1.10 | rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:1785332487 | RHSA-2026:48126 |
Frequently Asked Questions
Is CVE-2026-59877 in your dependencies?
Find it across npm, including transitive dependencies.