---
id: CVE-2026-48712
title: >-
  protobufjs: protobufjs: Denial of Service via uncontrolled recursion with
  crafted protobuf payload (CVE-2026-48712)
summary: >-
  A flaw was found in protobufjs. A remote attacker could exploit this by
  sending a crafted protobuf binary payload containing deeply nested 'Any'
  values. This uncontrolled recursion could exhaust the JavaScript call stack
  during conversion …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-606
  - CWE-674
vendor: Red Hat
product: Red Hat OpenShift AI 3.4
affected:
  - enterprise_linux_ai_rhel_ai 3
  - developer_hub 1.9
  - openshift_ai 3.4
patched:
  - developer_hub 1.9
  - openshift_ai 3.4
published: '2026-06-22'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T11:46:04+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-48712'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491451'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-48712'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48712'
  - url: >-
      https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6
  - url: 'https://access.redhat.com/errata/RHSA-2026:52768'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60520'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
  - url: 'https://github.com/advisories/GHSA-wcpc-wj8m-hjx6'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.0046
epssPercentile: 0.39697
aliases:
  - GHSA-wcpc-wj8m-hjx6
ecosystem: npm
ingestedAt: '2026-07-07T15:41:58.736Z'
---

## Overview

A flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS).

## Vendor advisories

- **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768)
- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json)

**protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload** — rated Moderate by Red Hat. Released 2026-06-22, updated 2026-10-19.

Affected:

- Red Hat Enterprise Linux AI (RHEL AI) 3

Fixed:

- Red Hat Developer Hub 1.9
- Red Hat OpenShift AI 3.4

No fix planned:

- Red Hat Enterprise Linux AI (RHEL AI) 3

Not affected:

- Red Hat Developer Hub 1.9
- Red Hat OpenShift AI 3.4
- Cryostat 4
- OpenShift Pipelines
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux 8
- Red Hat Hardened Images

## Remediation

For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:52768
For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520
For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734

Workarounds / mitigations:

- No specific mitigation required for unaffected runtime paths.

## Package advisory (CVE-2026-48712)

Affected packages:

- `protobufjs <= 7.6.0`
- `protobufjs >= 8.0.0, <= 8.4.0`

Patched in:

- `protobufjs 7.6.1`
- `protobufjs 8.4.1`

Source: https://github.com/advisories/GHSA-wcpc-wj8m-hjx6