AIKIDO-2026-115254
protobufjs is vulnerable to Denial of Service
34
Low Risk
This Affects:
protobufjsTL;DR
protobufjs parses and decodes protobuf, ProtoJSON, and Text Format input across its decoder, reader, and wrapper code paths. Crafted input can drive unbounded recursion when converting nested Any values from objects, force conversion of oversized integer literals through BigInt, and let length-delimited fields decode past their declared boundaries. Processing such malformed or hostile input can exhaust the call stack, consume excessive CPU and memory, or misparse fields across message boundaries, degrading or crashing the affected process. The fix caps Any.fromObject recursion, bounds integer literals before BigInt conversion, and enforces declared field lengths while decoding.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decodes or parses untrusted protobuf, ProtoJSON, or Text Format input.
Background info
protobufjs is vulnerable to Denial of Service in versions 0.0.0 - 8.7.2.
How to fix this
Upgrade the protobufjs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.