GHSA-jggg-4jg4-v7c6

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

Preconditions

The application must load JSON descriptor data influenced by an attacker.
The crafted descriptor must contain deeply nested nested namespace objects.
The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

Database specific

{
    "github_reviewed_at": "2026-05-19T16:21:33Z",
    "nvd_published_at": "2026-05-13T16:17:00Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-674"
    ],
    "severity": "MODERATE"
}

References

Affected packages

npm / protobufjs

Package

Name: protobufjs; View open source insights on deps.dev
Purl: pkg:npm/protobufjs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.5.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jggg-4jg4-v7c6/GHSA-jggg-4jg4-v7c6.json"

last_known_affected_version_range

"<= 7.5.7"

npm / protobufjs

Package

Name: protobufjs; View open source insights on deps.dev
Purl: pkg:npm/protobufjs

Affected ranges

Type: SEMVER
Events: Introduced

8.0.0

Fixed

8.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jggg-4jg4-v7c6/GHSA-jggg-4jg4-v7c6.json"