CVE-2026-45740
Fixed in a distro release EPSS <1%CVSS 5.3
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.
Products: protobufjs protobuf.js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | protobufjs | 7.5.8 |
| npm | protobufjs | 8.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cadence-web | 4.0.15-r2 |
| Chainguard | gemini-cli | 0.44.0-r0 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r24 |
| Chainguard | kibana-9.0 | 9.0.8-r29 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r29 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r29 |
| Chainguard | kibana-9.1 | 9.1.10-r18 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r18 |
| Chainguard | kibana-9.3 | 9.3.4-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.4-r4 |
| Chainguard | kibana-9.4 | 9.4.2-r2 |
| Chainguard | kibana-9.4 | 9.4.2-r0 |
| Chainguard | kibana-9.4-iamguarded | 9.4.2-r2 |
| Chainguard | kibana-9.4-iamguarded | 9.4.2-r0 |
| Chainguard | langfuse-3 | 3.175.0-r0 |
| Chainguard | langfuse-3-worker | 3.175.0-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r25 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r25 |
| Chainguard | langfuse-fips-3 | 3.175.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.175.0-r0 |
| Chainguard | librechat | 0.8.5-r1 |
| Chainguard | nemo | 2.7.3-r14 |
| Chainguard | pulumi-language-nodejs | 3.243.0-r2 |
| Chainguard | renovate | 43.170.15-r2 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-23 | 23.0.4-r5 |
| Red Hat Enterprise Linux 10.2 | rh-podman-desktop | 0:1.1.2-1.el10_2 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r24 |
| Wolfi | langfuse-3 | 3.175.0-r0 |
| Wolfi | langfuse-3-worker | 3.175.0-r0 |
| Wolfi | pulumi-language-nodejs | 3.243.0-r2 |
| Wolfi | renovate | 43.170.15-r2 |
| Wolfi | vitess-23 | 23.0.4-r5 |