CVE-2026-48712

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48712
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48712.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48712
Aliases
Downstream
Related
Published
2026-06-22T16:21:21.506Z
Modified
2026-07-15T01:49:16.282758323Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48712.json",
    "cwe_ids": [
        "CWE-674"
    ]
}
References

Affected packages

Git / github.com/protobufjs/protobuf.js

Affected ranges

Type
GIT
Repo
https://github.com/protobufjs/protobuf.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0b50d2fa1247d6652618190c2d6602e6830b90d
Introduced
933e8750dcd000c16a621a7344a4beaa034c4019
Fixed
e4320d06e8b0c00339d468df1cfc0dc08192597d
Database specific 
{
    "cpe": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.6.1"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.4.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.3.0
6.3.1
6.4.0
6.4.1
6.4.2
6.4.3
6.4.4
6.4.5
6.4.6
6.5.0
6.5.1
6.5.2
6.5.3
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
fetch-v1.*
fetch-v1.1.1
inquire-v1.*
inquire-v1.1.2
protobufjs-cli-v1.*
protobufjs-cli-v1.0.0
protobufjs-cli-v1.0.1
protobufjs-cli-v1.0.2
protobufjs-cli-v1.1.0
protobufjs-cli-v1.1.1
protobufjs-cli-v1.1.2
protobufjs-cli-v1.1.3
protobufjs-cli-v1.1.4
protobufjs-cli-v1.2.0
protobufjs-cli-v1.2.1
protobufjs-cli-v1.2.2
protobufjs-cli-v1.3.0
protobufjs-cli-v2.*
protobufjs-cli-v2.0.0
protobufjs-cli-v2.0.1
protobufjs-cli-v2.0.2
protobufjs-cli-v2.0.3
protobufjs-cli-v2.2.0
protobufjs-cli-v2.2.1
protobufjs-cli-v2.3.0
protobufjs-cli-v2.4.0
protobufjs-v7.*
protobufjs-v7.0.0
protobufjs-v7.1.0
protobufjs-v7.1.1
protobufjs-v7.1.2
protobufjs-v7.2.0
protobufjs-v7.2.1
protobufjs-v7.2.2
protobufjs-v7.2.3
protobufjs-v7.2.4
protobufjs-v7.2.5
protobufjs-v7.2.6
protobufjs-v7.3.0
protobufjs-v7.3.1
protobufjs-v7.3.2
protobufjs-v7.3.3
protobufjs-v7.4.0
protobufjs-v7.5.0
protobufjs-v7.5.1
protobufjs-v7.5.2
protobufjs-v7.5.3
protobufjs-v7.5.4
protobufjs-v7.5.5
protobufjs-v7.5.6
protobufjs-v7.5.7
protobufjs-v7.5.8
protobufjs-v7.5.9
protobufjs-v7.6.0
protobufjs-v8.*
protobufjs-v8.0.0
protobufjs-v8.0.1
protobufjs-v8.0.2
protobufjs-v8.0.3
protobufjs-v8.2.0
protobufjs-v8.2.1
protobufjs-v8.3.0
protobufjs-v8.4.0
v6.*
v6.10.0
v6.10.0-beta.0
v6.10.0-beta.1
v6.10.0-beta.2
v6.10.1
v6.10.1-beta.0
v6.10.2
v6.9.0
v6.9.0-beta.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48712.json"