CVE-2026-45740

What it actually does

protobufjs versions prior to 7.5.8 and 8.2.0 can perform unbounded recursion while expanding nested JSON descriptors via Root.fromJSON() and Namespace.addJSON(). A specially crafted descriptor containing deeply nested namespace definitions can exhaust the JavaScript call stack during descriptor loading, causing the affected Node.js or JavaScript process to throw a stack overflow error or terminate. The impact is limited to availability; the vulnerability does not directly provide code execution, data disclosure, or data modification.

Why it matters to the business

Applications or services that accept, load, import, or process untrusted protobuf JSON descriptors may be crashed or disrupted by a malicious descriptor, causing partial service outage, failed message/schema processing, job failures, or degraded reliability. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV, but services exposed to user-supplied schema files or descriptor imports should still prioritize remediation because exploitation requires no authentication and low complexity if the vulnerable parsing path is reachable.

How an attack unfolds

An attacker first identifies an application, API, build process, plugin system, or backend workflow that uses protobufjs to load protobuf definitions from JSON descriptors. The attacker then submits or causes the application to process a JSON descriptor with excessive nesting in namespace definitions. When the application calls Root.fromJSON() or Namespace.addJSON(), vulnerable protobufjs versions recursively expand the descriptor without enforcing a safe depth limit. The nested structure consumes the JavaScript call stack until the runtime raises a maximum call stack error or the process becomes unstable, resulting in denial of service for the affected worker, request handler, or service process. Exploitation is most plausible where descriptor JSON is accepted from users, partners, repositories, CI/CD inputs, uploaded files, or other untrusted sources.

How to fix it

Upgrade protobufjs to a fixed release: 7.5.8 or later on the 7.x line, or 8.2.0 or later on the 8.x line. If protobufjs is present transitively, update the parent dependency or use package manager overrides/resolutions to force a fixed protobufjs version, then rebuild and redeploy affected applications. Where immediate upgrade is not possible, restrict descriptor loading to trusted sources, reject or sanitize untrusted JSON descriptors, impose maximum nesting/depth limits before calling Root.fromJSON() or Namespace.addJSON(), enforce request/body size limits, run schema processing in isolated workers with restart controls, and rate-limit unauthenticated descriptor-processing endpoints.

How to confirm the fix worked

Confirm the installed protobufjs version is 7.5.8 or later, or 8.2.0 or later, using package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, SBOMs, or runtime package inspection. Search application code for Root.fromJSON() and Namespace.addJSON() to determine whether descriptor JSON can come from untrusted input. Validate dependency resolution with commands such as `npm ls protobufjs`, `yarn why protobufjs`, or `pnpm why protobufjs`. In a controlled test environment, attempt to load a deeply nested descriptor and verify the application rejects it safely or handles it without stack exhaustion. Confirm deployed containers, serverless bundles, and build artifacts contain the fixed package version, not only source repositories.

Typical attack path

1. Find an application or workflow that uses protobufjs and accepts or imports JSON protobuf descriptors.
2. Craft a protobuf JSON descriptor with deeply nested namespace definitions.
3. Submit the descriptor through an exposed API, upload function, plugin/package import, repository contribution, or other descriptor-loading path.
4. Trigger descriptor loading so the application calls Root.fromJSON() or Namespace.addJSON().
5. Cause uncontrolled recursion and JavaScript call stack exhaustion.
6. Disrupt the affected process, request worker, job runner, or service until it restarts or the malicious input is blocked.

How to detect it

Review application, API gateway, job runner, container, serverless, and process manager logs for crashes or exceptions occurring during protobuf JSON descriptor loading. Focus on log events around user uploads, schema imports, plugin/package ingestion, CI jobs, repository-driven builds, or API calls that process protobuf descriptors. Look for JavaScript stack exhaustion errors, repeated worker restarts, container restarts, HTTP 5xx spikes after descriptor submissions, and exceptions mentioning protobufjs Root.fromJSON or Namespace.addJSON. Examine submitted descriptor files or request bodies for unusually deep nesting under nested, namespaces, or similar descriptor namespace structures. Because no public exploit maturity is reported and EPSS is low, detection should emphasize anomalous crash patterns and malicious descriptor artifacts rather than known actor-specific indicators.

• RangeError: Maximum call stack size exceeded
• Maximum call stack size exceeded
• Root.fromJSON
• Namespace.addJSON
• protobufjs
• node:internal/errors
• FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed
• RangeError
• /node_modules/protobufjs/
• container restart
• CrashLoopBackOff

What your security team should do

• Inventory all applications, services, build tools, and packages using protobufjs, including transitive dependencies.
• Prioritize internet-facing or multi-tenant paths that accept uploaded, submitted, or repository-sourced protobuf JSON descriptors.
• Upgrade protobufjs to 7.5.8+ or 8.2.0+ and redeploy affected runtime artifacts.
• Add input validation for descriptor depth and size before invoking protobufjs descriptor-loading APIs.
• Add monitoring for repeated process crashes, JavaScript stack overflow errors, and spikes in descriptor parsing failures.
• If immediate patching is delayed, restrict descriptor import functionality to trusted users and authenticated workflows only.
• Add regression tests using deeply nested descriptor structures to prevent reintroduction of unbounded recursion behavior.