CVE-2026-59877

What it actually does

CVE-2026-59877 is a denial-of-service vulnerability in protobufjs prior to versions 7.6.5 and 8.6.6. When parsing Protocol Buffer schema definitions, protobufjs advances through tokens while parsing option names until it finds an equals sign. A malformed .proto schema that begins an option declaration but ends before the expected equals sign can cause parse-related code paths, including parse, Root.load, and Root.loadSync, to loop indefinitely. The result is CPU exhaustion or a hung Node.js process or build task that parses attacker-controlled or untrusted protobuf definitions. The flaw does not provide code execution, data disclosure, or direct integrity compromise, but it can reduce service availability wherever untrusted .proto input is accepted or processed automatically.

Why it matters to the business

The primary business risk is service disruption. Applications, CI/CD pipelines, developer tooling, API gateways, schema registries, ingestion services, or backend jobs that parse untrusted protobuf schemas may hang or consume resources until restarted. In internet-facing or multi-tenant services that accept uploaded .proto files, an unauthenticated attacker may be able to trigger repeated parsing failures and degrade availability. The CVSS score is moderate at 5.3, EPSS is low at 0.0037, it is not listed in CISA KEV, and no mature public exploitation is indicated, so broad emergency response is not generally warranted; however, systems that parse externally supplied protobuf schemas should be prioritized because exploitation is low-complexity and does not require authentication according to the CVSS vector.

How an attack unfolds

An attacker needs a path that causes a vulnerable protobufjs version to parse a protobuf schema they control. They craft a malformed .proto file containing an option declaration that starts but terminates before the parser reaches an equals sign. When a vulnerable application calls protobufjs parse, Root.load, or Root.loadSync on that schema, the parser repeatedly advances through tokens while searching for the missing delimiter and never exits normally. The affected worker, server process, CLI task, or build job can hang, tie up CPU, block the event loop, exhaust job capacity, or require manual termination. Repeating the request or supplying the malformed schema to batch-processing workflows can amplify the availability impact.

How to fix it

Upgrade protobufjs to a fixed release: version 7.6.5 or later for the 7.x line, or version 8.6.6 or later for the 8.x line. Because fixed_versions were not provided in the input package list, verify the exact installed package version through the relevant package manager lockfile and dependency tree. Rebuild and redeploy applications after dependency updates, including transitive dependencies that bundle or pin protobufjs. If immediate upgrade is not possible, mitigate by rejecting untrusted .proto schemas, applying strict schema validation before parsing, limiting accepted schema size and syntax, parsing in isolated worker processes with execution timeouts, and enforcing request/job rate limits. Avoid using synchronous parsing paths such as Root.loadSync on untrusted input in long-running service processes.

How to confirm the fix worked

Confirm all deployed artifacts and lockfiles resolve protobufjs to 7.6.5 or later, or 8.6.6 or later. Use package-manager inspection such as npm ls protobufjs, yarn why protobufjs, or pnpm why protobufjs to identify direct and transitive vulnerable versions. Validate that container images, serverless packages, CLI tools, and CI workers were rebuilt after the dependency change. In a non-production test environment, attempt to parse a malformed .proto file containing an unterminated option declaration and confirm the parser returns an error or terminates promptly rather than hanging. Also verify operational safeguards: parsing jobs should have timeouts, worker isolation, request limits, and monitoring for long-running schema parse operations.

Typical attack path

1. Identify an application, API, build service, schema registry, plugin system, or automation workflow that uses protobufjs to parse .proto schema content.
2. Confirm or infer that the target accepts user-supplied or remotely retrievable protobuf definitions rather than only trusted local schemas.
3. Submit or cause the system to load a crafted .proto schema with an unfinished option declaration that ends before an equals sign.
4. Trigger vulnerable protobufjs parsing through parse, Root.load, or Root.loadSync.
5. Cause the Node.js process, worker, or job to enter an infinite loop and stop making forward progress.
6. Repeat submissions or target concurrent workers to degrade service availability until vulnerable code is upgraded or input is rejected.

How to detect it

To determine whether exploitation has already occurred, focus on evidence of availability degradation around protobuf schema parsing rather than data theft. Review application logs, API gateway logs, upload logs, CI/CD job logs, schema registry logs, and Node.js process telemetry for requests or jobs involving .proto files that timed out, never completed, or were followed by process restarts. Look for repeated parse, Root.load, or Root.loadSync activity associated with malformed schemas, especially option declarations that start with "option" but do not contain an equals sign before end of file. Investigate spikes in CPU usage, event-loop lag, worker starvation, container restarts, health-check failures, and timeout errors correlated with protobuf parsing requests. If request bodies or uploaded files are retained, search for suspicious .proto content with unterminated option statements. There are no known public threat actors, KEV exploitation, ransomware association, or mature exploit indicators in the provided data, so detections should be behavior- and artifact-based.

• protobufjs
• Root.load
• Root.loadSync
• parse
• option
• '.proto'
• ".proto"
• CPU timeout
• event loop lag
• JavaScript heap out of memory
• Request timed out
• ETIMEDOUT
• SIGKILL
• SIGTERM
• Health check failed
• container restart
• npm ls protobufjs
• protobufjs@7.6.4
• protobufjs@7.6.3
• protobufjs@7.6.2
• protobufjs@7.6.1
• protobufjs@7.6.0
• protobufjs@8.6.5
• protobufjs@8.6.4
• protobufjs@8.6.3
• protobufjs@8.6.2
• protobufjs@8.6.1
• protobufjs@8.6.0

What your security team should do

• Inventory applications and build workflows that use protobufjs, especially services that accept uploaded, remote, or user-controlled .proto files.
• Prioritize upgrades for internet-facing, multi-tenant, or automated ingestion systems to protobufjs 7.6.5+ or 8.6.6+.
• Search dependency lockfiles and software composition analysis results for protobufjs versions earlier than 7.6.5 on the 7.x line and earlier than 8.6.6 on the 8.x line.
• Add input controls for protobuf schema uploads, including syntax validation, size limits, rate limits, and rejection of malformed option declarations before invoking vulnerable parsers.
• Run protobuf parsing in bounded worker processes with CPU, memory, and wall-clock time limits so parser hangs cannot block the main service process.
• Monitor for abnormal increases in Node.js CPU usage, event-loop stalls, hung schema parsing jobs, request timeouts, and repeated malformed .proto submissions.
• Because the issue is not in CISA KEV and EPSS is low, handle through prioritized patch management rather than emergency incident response unless the product parses untrusted schemas from the network.