Skip to content
Fencer Vulns
medium 5.3

CVE-2026-59877 json

protobufjs: Denial of Service via infinite loop in .proto option parsing

published 2026-07-08 4 mo ago modified 2026-10-25 14 d ago also GHSA-j3f2-48v5-ccww , EUVD-2026-42310

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits
0
none known

Summary

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Patch / fix

  • npm protobufjs 7.6.5, 8.6.6
  • protobufjs_project protobufjs 7.6.5, 8.6.6
  • rh-podman-desktop RHEL 10.2 1.1.2-1.el10_2

red hat advisories RHSA-2026:57590

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59877 updated cvss 7.5

protobufjs: protobufjs: Denial of Service via crafted .proto schema

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.10-1.el9ap Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: workaround, no fix available
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9
    affected: workaround, no fix available
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-14
    fixed: vendor fix RHSA-2026:68333
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1785854226
    fixed: vendor fix RHSA-2026:50850
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1785857303, ansible-automation-platform/bootc-automation-portal-rhel9 1786006573
    fixed: vendor fix RHSA-2026:50839
show 14 more
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1789666472
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1788918510
    fixed: vendor fix RHSA-2026:67279
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1785972843
    fixed: vendor fix RHSA-2026:52768
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1785411652, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend 1785332487, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1785332825
    fixed: vendor fix RHSA-2026:48126
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1787590523
    fixed: vendor fix RHSA-2026:60477
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1787158341
    fixed: vendor fix RHSA-2026:57365
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1787762793
    fixed: vendor fix RHSA-2026:62260
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1784806326, openshift-service-mesh/kiali-ossmc-rhel9 1784824388
    fixed: vendor fix RHSA-2026:49680
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1784806708, openshift-service-mesh/kiali-ossmc-rhel9 1784824894
    fixed: vendor fix RHSA-2026:49735
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-14, cryostat/cryostat-db-rhel9 4.2.0-22, cryostat/jfr-datasource-rhel9 4.2.0-14, cryostat/cryostat-reports-rhel9 4.2.0-14, cryostat/cryostat-storage-rhel9 4.2.0-22, cryostat/cryostat-rhel9-operator 4.2.0-21, +3 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/controller-rhel9 1789673739, ansible-automation-platform-26/de-minimal-rhel9 1789658734, +24 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/hub-web-rhel9 1788924567, ansible-automation-platform-27/receptor-rhel9 1788918370, ansible-automation-platform-27/mcp-tools-rhel9 1788917342, ansible-automation-platform-27/controller-rhel9 1788918363, ansible-automation-platform-27/de-minimal-rhel9 1788920534, +25 more Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1785972533, rhdh/rhdh-operator-bundle 1785976147 Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1785411290, rhdh/rhdh-operator-bundle 1785415596, rhdh/rhdh-must-gather-rhel9 1784202439, rhdh/rhdh-rag-content-rhel9 1785162496, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1785333413, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1785340831, +3 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    not affected: vulnerable code not in execute path
  • Red Hat Hardened Images dotnet9.0 9.0.118-1.hum1
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1787555870, openshift4/ose-cli-rhel9 1787556246, openshift4/ose-pod-rhel9 1787558631, openshift4/ose-etcd-rhel9 1787562282, openshift4/ose-tests-rhel9 1787563149, openshift4/ose-tools-rhel9 1787557205, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1786964976, openshift4/ose-cli-rhel9 1786965815, openshift4/ose-pod-rhel9 1787118353, openshift4/ose-etcd-rhel9 1786971601, openshift4/ose-tests-rhel9 1787012092, openshift4/ose-tools-rhel9 1787010320, +182 more Red Hat OpenShift Dev Spaces 3.30 devspaces/udi-rhel9 1787764814, devspaces/server-rhel9 1787757597, devspaces/openvsx-rhel9 1787759145, devspaces/traefik-rhel9 1787756799, devspaces/udi-base-rhel9 1787761882, devspaces/code-sshd-rhel9 1787762385, +10 more Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9-operator 1784795355, openshift-service-mesh/kiali-operator-bundle 1784923616
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm protobufjs
>=7.5.0, <7.6.5
>=8.0.0, <8.6.6
7.6.5
8.6.6

Affected products

  • protobufjs protobuf.js

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.