CVE-2026-48712: protobufjs Denial of Service through Unbounded Any Expansion during JSON Conversion
Summary
CVE-2026-48712: protobufjs: Denial of service through unbounded Any expansion during JSON conversion. Affects protobufjs across 2 version ranges.
< 7.6.1
>= 8.0.0, < 8.4.1
Fixed in 7.6.1 or 8.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
protobufjs is a popular JavaScript library used for encoding and decoding Protocol Buffers, a method developed by Google for serializing structured data. It allows developers to work with Protocol Buffers in a JavaScript environment, providing features such as message encoding, decoding, and conversion to JSON. However, it has a vulnerability that can lead to denial of service when handling untrusted protobuf binary data containing deeply nested Any values.
Vulnerability Detail
The vulnerability arises from the lack of a depth limit during the conversion of decoded messages to plain objects or JSON. Specifically, when a crafted protobuf binary payload containing deeply nested google.protobuf.Any values is processed, the library may recurse indefinitely, exhausting the JavaScript call stack. This can lead to a stack overflow, causing the application to crash or fail during message conversion. Applications that decode untrusted protobuf input and convert it to JSON are particularly at risk.
How To Fix
Latest published version: 8.8.1 as of 23 Oct 2026
npm install protobufjs@8.8.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.6.17.6.1npm install protobufjs@7.6.1 -
>= 8.0.0, < 8.4.18.4.1npm install protobufjs@8.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds: 1. Reject or limit messages with deeply nested Any payloads at an outer protocol boundary. 2. Avoid JSON conversion of untrusted Any values. 3. Isolate message conversion in a separate process that can be safely restarted.
Conclusion
The CVE-2026-48712 vulnerability in protobufjs poses a significant risk of denial of service due to unbounded recursion during JSON conversion. It is crucial for developers to update to the latest patched versions or implement workarounds to protect their applications from potential crashes.
See every vulnerability recorded for protobufjs →
FAQ
CVE-2026-48712 is a vulnerability in the protobufjs library that can lead to denial of service through unbounded recursion during JSON conversion of deeply nested Any values.
If your application decodes untrusted protobuf binary data containing google.protobuf.Any values and converts them to JSON, it may crash or fail due to a stack overflow.
Versions 7.6.0 and below, as well as 8.4.0 and below, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Implement workarounds such as rejecting deeply nested Any payloads or isolating message conversion in a separate process to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobufjs.
