CVE-2026-59877

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59877
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59877.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59877
Aliases
Downstream
CGA (63)
CLEANSTART (5)
MINI (10)
RHSA (1)
ROOT (1)
Published
2026-07-08T15:28:07Z
Modified
2026-10-16T03:00:08Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
protobufjs: Denial of Service via infinite loop in .proto option parsing
Details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59877.json"
}
References

Affected packages

Git / github.com/protobufjs/protobuf.js

Affected ranges

Type
GIT
Repo
https://github.com/protobufjs/protobuf.js
Events
Introduced
1dbcfe322899aca50fb82916db7802f647f23f0e
Fixed
89048ba0bbf3ed78f77199102f0614dafc2b4860
Introduced
933e8750dcd000c16a621a7344a4beaa034c4019
Fixed
55e4c8f8eadfc21c848f6a1eedd1b383a3720099
Fixed
10fba6d54815ceecca8a06b9a6db490c8f5d2217
Fixed
fa5c73add738ceb471e74da8cc2f3727c3d0a69f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "7.5.0"
                },
                {
                    "fixed": "7.6.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.6.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "10fba6d54815ceecca8a06b9a6db490c8f5d2217"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "protobufjs-v7.6.5",
            "range": [
                {
                    "fixed": "89048ba0bbf3ed78f77199102f0614dafc2b4860"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "protobufjs-v8.6.6",
            "range": [
                {
                    "fixed": "55e4c8f8eadfc21c848f6a1eedd1b383a3720099"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

aspromise-v1.*
aspromise-v1.1.2
base64-v1.*
base64-v1.1.2
codegen-v2.*
codegen-v2.0.5
eventemitter-v1.*
eventemitter-v1.1.1
fetch-v1.*
fetch-v1.1.1
float-v1.*
float-v1.0.2
inquire-v1.*
inquire-v1.1.2
path-v1.*
path-v1.1.2
pool-v1.*
pool-v1.1.0
protobufjs-cli-v1.*
protobufjs-cli-v1.2.0
protobufjs-cli-v1.2.1
protobufjs-cli-v1.2.2
protobufjs-cli-v1.3.0
protobufjs-cli-v1.3.1
protobufjs-cli-v1.3.2
protobufjs-cli-v1.3.3
protobufjs-cli-v2.*
protobufjs-cli-v2.0.0
protobufjs-cli-v2.0.1
protobufjs-cli-v2.0.2
protobufjs-cli-v2.0.3
protobufjs-cli-v2.2.0
protobufjs-cli-v2.2.1
protobufjs-cli-v2.3.0
protobufjs-cli-v2.4.0
protobufjs-cli-v2.4.1
protobufjs-cli-v2.4.2
protobufjs-cli-v2.5.0
protobufjs-cli-v2.5.1
protobufjs-cli-v2.5.2
protobufjs-cli-v2.5.3
protobufjs-cli-v2.5.4
protobufjs-cli-v2.5.5
protobufjs-cli-v2.5.6
protobufjs-v7.*
protobufjs-v7.5.0
protobufjs-v7.5.1
protobufjs-v7.5.2
protobufjs-v7.5.3
protobufjs-v7.5.4
protobufjs-v7.5.5
protobufjs-v7.5.6
protobufjs-v7.5.7
protobufjs-v7.5.8
protobufjs-v7.5.9
protobufjs-v7.6.0
protobufjs-v7.6.1
protobufjs-v7.6.2
protobufjs-v7.6.3
protobufjs-v7.6.4
protobufjs-v8.*
protobufjs-v8.0.0
protobufjs-v8.0.1
protobufjs-v8.0.2
protobufjs-v8.0.3
protobufjs-v8.2.0
protobufjs-v8.2.1
protobufjs-v8.3.0
protobufjs-v8.4.0
protobufjs-v8.4.1
protobufjs-v8.4.2
protobufjs-v8.5.0
protobufjs-v8.6.0
protobufjs-v8.6.1
protobufjs-v8.6.2
protobufjs-v8.6.3
protobufjs-v8.6.4
protobufjs-v8.6.5
utf8-v1.*
utf8-v1.1.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59877.json"