CVE-2026-48712High· 7.5▾ TwilightA flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
Last analysed / modified upstream
A flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS).
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload — rated Moderate by Red Hat. Released 2026-06-22, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:52768 For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520 For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Workarounds / mitigations:
Affected packages:
protobufjs <= 7.6.0protobufjs >= 8.0.0, <= 8.4.0Patched in:
protobufjs 7.6.1protobufjs 8.4.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81724High· 7.5nltk: NLTK: Denial of Service via Uncontrolled Recursion (CVE-2026-81724)
CVE-2026-19484High· 7.5fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
CVE-2026-13311Medium· 6.5shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing (CVE-2026-13311)
CVE-2026-59874High· 7.5tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
CVE-2026-49978High· 8.1dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)