Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 29.1%
CVSS Severity
CVSS v3 Score 5.3
Products affected by CVE-2026-59877


Contact Us

Shodan ® - All rights reserved