CVE-2026-59877
Fixed in a distro release EPSS <1%CVSS 5.3
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Products: protobufjs protobuf.js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | protobufjs | 7.6.5 |
| npm | protobufjs | 8.6.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cadence-web | 4.0.16-r2 |
| Chainguard | homepage | 1.13.2-r5 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r30 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.4 | 9.4.4-r0 |
| Chainguard | kibana-9.4-iamguarded | 9.4.4-r0 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r25 |
| Chainguard | langfuse-fips-3 | 3.222.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.222.0-r0 |
| Chainguard | librechat | 0.8.7-r5 |
| Chainguard | nemo | 2.7.3-r14 |
| Chainguard | opentelemetry-auto-instrumentations-node | 0.79.0-r0 |
| Chainguard | pulumi-language-nodejs | 3.253.0-r2 |
| Chainguard | thingsboard-tb-js-executor-fips | 4.3.1.3-r3 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-24 | 24.0.2-r6 |
| Chainguard | vitess-24-compat | 24.0.3-r7 |
| Red Hat Enterprise Linux 10.2 | rh-podman-desktop | 0:1.1.2-1.el10_2 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r30 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r25 |
| Wolfi | pulumi-language-nodejs | 3.253.0-r2 |
| Wolfi | vitess-24 | 24.0.2-r6 |
| Wolfi | vitess-24-compat | 24.0.3-r7 |