CVE-2026-59877High· 7.5▾ TwilightA flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an op…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
5.3 → 7.5
medium → high
0.4% → 0.7%
Last analysed / modified upstream
A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.
protobufjs: protobufjs: Denial of Service via crafted .proto schema — rated Important by Red Hat. Released 2026-07-08, updated 2026-10-06.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:50850
Workarounds / mitigations:
Affected packages:
protobufjs >= 7.5.0, <= 7.6.4protobufjs >= 8.0.0, <= 8.6.5Patched in:
protobufjs 7.6.5protobufjs 8.6.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-101607Medium· 4.9mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607)
CVE-2026-101755Medium· 5.3mysql: mysql: Denial of Service via client programs (CVE-2026-101755)
CVE-2026-101776Medium· 4.9mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776)
CVE-2026-101787Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787)
CVE-2026-101798Medium· 4.9mysql: mysql: Denial of Service in the server optimizer (CVE-2026-101798)